{"report_id":"53e7419d-6211-45e4-8ed4-f7acca6f688b","version":6,"status":"done","tags":[],"date":"2026-01-20T12:19:22Z","url":{"schema":"http","addr":"midasx.specialfor.za.com","fqdn":"midasx.specialfor.za.com","domain":"specialfor.za.com","tld":"za.com"},"ip":{"addr":"43.160.250.121","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"https","addr":"midasx.specialfor.za.com/","fqdn":"midasx.specialfor.za.com","domain":"specialfor.za.com","tld":"za.com"},"title":"Midasbuy x PUBG MOBILE Event","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"midasx.specialfor.za.com","fqdn":"midasx.specialfor.za.com","domain":"specialfor.za.com","tld":"za.com"},"ip":{"addr":"43.160.250.121","port":0,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-24T12:19:22Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":2,"urlquery":0,"analyzer":5}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-20T12:19:00Z","timestamp":1768911540,"ip_dst":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":33426,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare workers.dev Domain in TLS SNI","source":"{\"timestamp\":\"2026-01-20T12:19:00.987812+0000\",\"flow_id\":898225614929223,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":33426,\"dest_ip\":\"188.114.96.1\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2051768,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare workers.dev Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_03_22\"],\"deployment\":[\"Perimeter\"],\"malware_family\":[\"Cloudflare_Workers\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Cloudflare_Workers\"],\"updated_at\":[\"2024_03_22\"]}},\"tls\":{\"sni\":\"pro.edgeonetech.workers.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":929,\"bytes_toclient\":3553,\"start\":\"2026-01-20T12:19:00.965959+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-20T12:19:00Z","timestamp":1768911540,"ip_dst":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":33440,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Cloudflare workers.dev Domain in TLS SNI","source":"{\"timestamp\":\"2026-01-20T12:19:00.988831+0000\",\"flow_id\":1487398491176463,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.13\",\"src_port\":33440,\"dest_ip\":\"188.114.96.1\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2051768,\"rev\":1,\"signature\":\"ET INFO Observed Cloudflare workers.dev Domain in TLS SNI\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"affected_product\":[\"Any\"],\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_03_22\"],\"deployment\":[\"Perimeter\"],\"malware_family\":[\"Cloudflare_Workers\"],\"performance_impact\":[\"Low\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"Cloudflare_Workers\"],\"updated_at\":[\"2024_03_22\"]}},\"tls\":{\"sni\":\"pro.edgeonetech.workers.dev\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":789,\"bytes_toclient\":3479,\"start\":\"2026-01-20T12:19:00.966159+0000\"}}"}],"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"midasx.specialfor.za.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"midasx.specialfor.za.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"midasx.specialfor.za.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.harvestsharp.com","ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2021-03-12","domain_rank":1960258,"first_seen":"2023-10-10T12:59:35Z","last_seen":"2025-06-29T16:22:00.086187Z","alert_count":0,"request_count":42,"received_data":191631,"sent_data":21062,"comment":"","tags":null,"fingerprints":null},{"fqdn":"i.imgur.com","ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2009-01-09","domain_rank":3309,"first_seen":"2012-05-21T08:09:36Z","last_seen":"2026-01-14T11:09:45.415254Z","alert_count":0,"request_count":15,"received_data":3454978,"sent_data":6586,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-18T22:14:28.232245Z","alert_count":0,"request_count":1,"received_data":40963,"sent_data":557,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-01-18T22:25:16.015191Z","alert_count":0,"request_count":2,"received_data":175036,"sent_data":987,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2026-01-18T22:30:25.777558Z","alert_count":0,"request_count":1,"received_data":18790,"sent_data":440,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-18T22:17:29.309663Z","alert_count":0,"request_count":2,"received_data":252424,"sent_data":1058,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"midasx.specialfor.za.com","ip":{"addr":"43.160.250.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"domain_registered":"2025-10-03","domain_rank":0,"first_seen":"2025-10-12T03:26:45.004253Z","last_seen":"2025-10-12T03:26:45.004253Z","alert_count":6,"request_count":2,"received_data":2922,"sent_data":959,"comment":"","tags":null,"fingerprints":[{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]},{"fqdn":"udgqcvkk.fortoday.asia","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-09-26","domain_rank":0,"first_seen":"2026-01-20T12:19:26.351829Z","last_seen":"2026-01-20T12:19:26.351829Z","alert_count":154,"request_count":77,"received_data":6473273,"sent_data":36939,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"jQuery:1.9.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]}]},{"fqdn":"stackpath.bootstrapcdn.com","ip":{"addr":"104.18.11.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-05-25","domain_rank":21970,"first_seen":"2018-04-05T04:41:29Z","last_seen":"2026-01-18T23:51:57.03484Z","alert_count":0,"request_count":1,"received_data":31942,"sent_data":479,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"pagedoo.midasbuy.com","ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2018-06-05","domain_rank":2848692,"first_seen":"2023-05-26T02:11:09Z","last_seen":"2026-01-09T18:37:25.612317Z","alert_count":0,"request_count":1,"received_data":34273,"sent_data":493,"comment":"","tags":null,"fingerprints":null},{"fqdn":"site-assets.fontawesome.com","ip":{"addr":"104.18.40.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2012-10-18","domain_rank":380600,"first_seen":"2022-02-10T06:20:21Z","last_seen":"2026-01-14T11:24:18.862894Z","alert_count":0,"request_count":1,"received_data":498719,"sent_data":464,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"code.jquery.com","ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2005-12-10","domain_rank":4915,"first_seen":"2012-05-21T17:28:02Z","last_seen":"2026-01-18T22:42:00.173248Z","alert_count":0,"request_count":2,"received_data":187392,"sent_data":862,"comment":"","tags":null,"fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"cdn.midasbuy.com","ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"domain_registered":"2018-06-05","domain_rank":1886290,"first_seen":"2020-07-20T02:57:04Z","last_seen":"2026-01-09T18:37:25.125567Z","alert_count":0,"request_count":7,"received_data":1732,"sent_data":3753,"comment":"","tags":null,"fingerprints":null},{"fqdn":"ajax.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2026-01-18T22:51:50.191561Z","alert_count":0,"request_count":5,"received_data":434649,"sent_data":2255,"comment":"","tags":null,"fingerprints":null},{"fqdn":"pro.edgeonetech.workers.dev","ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2019-02-08","domain_rank":0,"first_seen":"2025-12-13T04:43:53.201302Z","last_seen":"2026-01-09T18:37:24.954032Z","alert_count":0,"request_count":8,"received_data":6191,"sent_data":3978,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/disable-devtool@latest","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7fa174926682313cc5a067077b0bb22d","sha1":"609109d82deb0c7dd3d9d212808dcba0548ce3d1","sha256":"5a7b9b2c807f85575c9ebc1f508e849b53430870b2d0fb6c02b2de3df661cb63","sha512":"83a593d4b8648b78031259becd96b4c33226e9462c2e26013ee0746ff58a7b710159d0d380d001d7740e9485ee346491c16e3fdb0d334f5b6cfabe6f90cda9b6","ssdeep":"192:m+5ekRvDLCpBK+BpP78nPk6O9ShgzsqcSYV0GtI+uwicvsbIUiJE2KmnyKU:mLiPCvRvT8nPk6cSCzsqGVJeZcsb8S9","tlshash":"0582c4ccb48270715b77a9e9507f454ab23aae96888c8040f13ed8e42c7c56ec267f7d","size":17684,"data":"","first_seen":"2025-08-02T03:49:54.562881Z","last_seen":"2026-07-26T23:24:27.527814Z","times_seen":4870,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/lenzz.fb053b3a.js","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"bf637ae8f033ba448fd2915fd13225e0","sha1":"9355c61c57c96d485511b836acbb9559cf6141ae","sha256":"e91c75efa11265a18f108f2b4a8c76ead095f207ecd9981384c2bae0dc51a3e6","sha512":"5db0cae5005c66872b99d80fa444c0c0cfa5a07f5f82f15786614c46dc588b7bab68833607d97a4d21956fee23cf39c791178219ee78be8a43bef9ba4b64a4df","ssdeep":"384:veivMiyzYFBr9R3FvLF6c7Onfpt6OxeQkkQqoflTvz0tHwGSCA6a883K06:vvvByz9c7dGa6","tlshash":"b3b20109b6d61d912d37a4b611bb40043b5c580b150adf08f87d6ac82f51fbafe77a8e","size":24889,"data":"","first_seen":"2026-01-20T12:19:48.028798Z","last_seen":"2026-02-10T22:46:25.355924Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"32015dd42e9582a80a84736f5d9a44d7","sha1":"41b4bfbaa96be6d1440db6e78004ade1c134e276","sha256":"8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3","sha512":"eda31b5c7d371d4b3acced51fa92f27a417515317cf437aae09a47c3acc8a36bdbb5a5e70f0fbfd82d3725edf45850dde8ca52c20f9a2d6e038b8eaaceee3cf1","ssdeep":"1536:AP1vk7i6GUHdXXeyQazBu+4HhiO2wd0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrb:z4UdWJiz6UAIJ8pa98Hrb","tlshash":"a283d6d9b2c67062977734b851bf410bb17a98dab80c8c60f0a4d4e47eb4a8d517bf2d","size":84320,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T16:52:45.073576Z","times_seen":16125,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e40ec2161fe7993196f23c8a07346306","sha1":"afb90752e0a90c24b7f724faca86c5f3d15d1178","sha256":"874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4","sha512":"5f57cc757fff0e9990a72e78f6373f0a24bce2edf3c4559f0b6fef3cf65edf932c0f3eca5a35511ea11eabc0a412f1c7563282ec76f6fa005cc59504417159eb","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa98:7NMnJiz6oAQKP5a98Hrh","tlshash":"db83d6d9b2c67062977730b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","size":84245,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T23:24:27.534542Z","times_seen":59785,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-1.10.2.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","size":93107,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-27T00:09:49.201613Z","times_seen":16822,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"32015dd42e9582a80a84736f5d9a44d7","sha1":"41b4bfbaa96be6d1440db6e78004ade1c134e276","sha256":"8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3","sha512":"eda31b5c7d371d4b3acced51fa92f27a417515317cf437aae09a47c3acc8a36bdbb5a5e70f0fbfd82d3725edf45850dde8ca52c20f9a2d6e038b8eaaceee3cf1","ssdeep":"1536:AP1vk7i6GUHdXXeyQazBu+4HhiO2wd0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrb:z4UdWJiz6UAIJ8pa98Hrb","tlshash":"a283d6d9b2c67062977734b851bf410bb17a98dab80c8c60f0a4d4e47eb4a8d517bf2d","size":84320,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T16:52:45.073576Z","times_seen":16125,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midasx.specialfor.za.com/","fqdn":"midasx.specialfor.za.com","domain":"specialfor.za.com","tld":"za.com"},"ip":{"addr":"43.160.250.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"d1ea90378d7239b92c2496fdebd8ba6f","sha1":"4278fb69a027590d9d41fa9e6c99bedd40e887a2","sha256":"f936d4a94fd2321c6caf5a452a099f56f823d64d8c32229449b22c7378eafe46","sha512":"ea7ccdfd79845ac0bae9b7deef57dff91e400cd1cf6ad5f4e36f91e17f676096cd8a45753275b1c128ebc5d1faf5096f89097dfc451a889234603821c82e264c","ssdeep":"","tlshash":"e1d022d7302282399608228322aea8c826a9867078898a389c70d6080030a03a002bea","size":197,"data":"","first_seen":"2026-01-20T12:19:48.064675Z","last_seen":"2026-02-10T22:46:25.465173Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/index.js","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1576c7c8eef31ed7e76bb206ba563e6b","sha1":"8fc4fe74014fcf994321450cab9cc9bd939bee50","sha256":"d0e603a02ad3bbfbb51d0f26841a9dd26023e6ae34b05f8f8562d0f675591d32","sha512":"2877d640a2a46c3f36dc547ebc7a831e9df647bd7bd69d1e9014d98f05c93a20ead75b2497a04270faa8cbcb02d0f3b1d59751ede29e2bb2adf51d0663cecdf5","ssdeep":"192:WiaFhJw3Verhd/bNcpuOoK/bLCY8/G5lWqoKJPcG8NgKDC46LL/08bSDdfb:W1/JJepuOoK/bLCY8/8lWqoKJkG8NgYr","tlshash":"9102c0093ec055ca0b0a76be6e17e4e6e52518ec25e4030fd391b865bbd822fe996634","size":8446,"data":"","first_seen":"2026-01-20T12:19:47.95254Z","last_seen":"2026-02-10T22:46:25.376195Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/flaglink.js","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a3de47d0c5149149bebc1ed56b6f7188","sha1":"43cdb6fc2a89067836557854b75cfa7f313437c0","sha256":"0348365d4d16c36ac5a1f83f46603b4266fa18902aa1b70c4ba6d5a1ec74e7da","sha512":"68b5ece26e190331743a22f2756f0806e16b8f35fc87e0e330c2d9e6589868be0e3d2dc37175c9aec38f6a02b0eb44532f5963897d46fac6ebdc9619788c1ef7","ssdeep":"3072:Pabuvjtl8VAqI7H+bGwbGKGQjNBmnnYdvw:P37/LebGwbGCi","tlshash":"f364f062d636a717b371b56c42a37dc9d98c6adbc0884cca39fe9b8d0f3d4b2459c118","size":320021,"data":"","first_seen":"2025-01-22T15:28:39.269469Z","last_seen":"2026-05-13T13:04:07.265521Z","times_seen":12,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-1.10.2.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","size":93107,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-27T00:09:49.201613Z","times_seen":16822,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"about","addr":"about:blank","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"0bdd6c9eedb801dbb4d47d7d39da5ae4","sha1":"e6e484e98d921423625a78ce8e1e600f9d7c1a41","sha256":"3da4306a3ba1fe347e57ebb248dea32d9855b11c7b883fbe4996d4ac62830303","sha512":"72271b72cc65786299185b6c245ca4bd26c5d40e0b6c9e7883d23e3e9194e9c6115551197718e035d0a3887b00cf20057be337bb508446e80e2bf1924372760e","ssdeep":"","tlshash":"b4d023e51a75883061d6014a1076e7d8267021a47721a504d1dccd5b6f11ff314b155c","size":217,"data":"","first_seen":"2026-01-20T12:19:48.06589Z","last_seen":"2026-02-10T22:46:25.463377Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"397754ba49e9e0cf4e7c190da78dda05","sha1":"ae49e56999d82802727455f0ba83b63acd90a22b","sha256":"c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4","sha512":"8c64754f77507ab2c24a6fc818419b9dd3f0ceccc9065290e41afdbee0743f0da2cb13b2fbb00afa525c082f1e697cb3ffd76ef9b902cb81d7c41ca1c641dffb","ssdeep":"1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe","tlshash":"8c932bdd72d2b03257ab30bd106f540ff2361959280d8850f268d8f9bc79a49a277f6d","size":92629,"data":"","first_seen":"2023-03-07T01:02:08Z","last_seen":"2026-07-26T23:40:36.322592Z","times_seen":71635,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"e40ec2161fe7993196f23c8a07346306","sha1":"afb90752e0a90c24b7f724faca86c5f3d15d1178","sha256":"874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4","sha512":"5f57cc757fff0e9990a72e78f6373f0a24bce2edf3c4559f0b6fef3cf65edf932c0f3eca5a35511ea11eabc0a412f1c7563282ec76f6fa005cc59504417159eb","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa98:7NMnJiz6oAQKP5a98Hrh","tlshash":"db83d6d9b2c67062977730b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","size":84245,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T23:24:27.534542Z","times_seen":59785,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"6e4e7b74b59e8fb0d5cc5b6878b1257b","sha1":"906cafd0b72e7ee02cbdbf1bed7d4c33b45d7d20","sha256":"d12ca570dbc2a31175dac8e301b0e1212bcd5fca4e860720f6fce957cadb5f83","sha512":"34bc474f7b2b79080645417e5117ba26ea0816cca04f074eecb47906d971a31006a0820209d7f03fdbb35f0d8c1dd4ce025510d9341700bdfe3c126a9763ec85","ssdeep":"","tlshash":"f0a0120001588644015740d1873085c47db88322f8004440c90d06b049c1a8c5206330","size":81,"data":"","first_seen":"2023-08-14T12:40:35Z","last_seen":"2026-05-31T06:09:53.890328Z","times_seen":283,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"2cf7f8537af0f6efe222b769976f1fd7","sha1":"178216d925181ac28aedafb7f2f7d45b72393f04","sha256":"f103fc041723a954c07f5f7f1688778dd5c334b549d5cf76a759480b55712532","sha512":"d28201f12c14f8079b46966fb9d8f55872ec55186427505085415976271b0a3f05f105d7707fa7049312a6629dad57f9356cf168ffd028bd20fde2554994a20e","ssdeep":"","tlshash":"8ff0a71837d708124d22f166661d5b495db2430205838e4c6dcd50c1afded369ad6ba9","size":457,"data":"","first_seen":"2026-01-20T12:19:48.067702Z","last_seen":"2026-02-10T22:46:25.462109Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"b26a944cd672b5f9c1e74ea0e9dce3ce","sha1":"cee9375123ce4263f950ef095bd6b4e36545232d","sha256":"b117cd703b58fdea476daf27b6586b5676a91b97694747853b583f39bafad494","sha512":"b379d1db4152fdf6a893ae5621bb60cbb69e467c94fa37692f7843bc14c9bc464affb47799e21fa0455166cedebbd227e20e3eecd222ad4fb3cc33711aed2035","ssdeep":"","tlshash":"031100b53b1a2534c5c6408b317ee7a93e3220757a02a044c36ccc285d18e9314efcbe","size":902,"data":"","first_seen":"2026-01-20T12:19:48.068983Z","last_seen":"2026-02-10T22:46:25.464285Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7198f76d9cb882e53390bb18093e1aee","sha1":"a97588209f94b778d27ec5966825e9d8494d8372","sha256":"4f699714f7c1749b9dba45cacad91add4cb39273ae141691e87c52fddb962937","sha512":"20b98c9882ad322493be838cf52cfd4f91447630382ec3595aeccef2534c2a9ae6cfeeba8b34c1835da747e90b1b7a2c64fe314d63eb7ebff4ecb96efbc650e2","ssdeep":"384:OD+cku3iUwsAY2tF6UepI1nCQcuq+1DrebsbUDrHPbNhfRWnPTMeqLYWwC399NX+:2dkNsAY2tpCQcuq+1DrebsbUDrHPbNhA","tlshash":"758284d63cc6766e43aa30728c6b35cff16e6dc174240805821cf8e8bdb677991a7e58","size":19174,"data":"","first_seen":"2026-01-20T11:44:57.113482Z","last_seen":"2026-01-20T12:27:45.750441Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"da8268b7f06713dcb4a225ed4352c5b7","sha1":"64e26d66dbc71a35e56b995b7ed2952cd4416698","sha256":"4565f77725f2acb3bb1ddbd1a8154d6156bf0d399bc87dd62e22e5bd836468ad","sha512":"c27bc82eb01362abcc12fb842e191ca7707094db84b65e851fd51f582d3cd7f6d64ded9289adb6eac0b3c68b68dcebcae80fecc8c7deef08b1e0b111b85b5b3c","ssdeep":"","tlshash":"d17000000020800000cf08c00238000000b20300c2800080ca0003f002a000cc8c3080","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.4073Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"0aaabba7ccc2505b6870a656b6819d3b","sha1":"5ee2b0096cb5a7a03db1452893d0f0efbd3f051c","sha256":"f32cced9669187aebe75ba41a8f0d897a27cb02bbcd5dcf0ad6dbfe31cc208a0","sha512":"793ef6b9664aae05ee972825cf2fa3b60dafbae9706788a1f4cbedee19d357fc9ddcbf7107f0beb2a7ae1c2f29794568e9cf39ef16f17ff2494ceca583f4777a","ssdeep":"","tlshash":"eb7000000000c00000cf00c00030fcc300f00300c000033fc00003f0030000cc003033","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.389778Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f2bafedfaadb0f2669dd99db32cfaec2","sha1":"26952b7bb4226705e8f86f7f191ff4e5a5f8ecff","sha256":"3d7208cc324b7fd6b0e4582c2b82b92314b1d40f918f7cffef7054ff38888eff","sha512":"d943867aa83336c8770bf2711bafe1343d3b2403f07ea6ad24b481e4dd5f7b39304fad4f438be998732313b552dc6f8f72270a14f65ac47c8b8e08a019fd6365","ssdeep":"","tlshash":"b07000c00000c00000cf00c00030000000f00f00c0003000c003f3f0030330cc00300c","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.397563Z","times_seen":1162,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"2f5270701fdc3701859bc4c4c050d9ee","sha1":"709cb0666d8c2d6ac55bf7c6cdd5fdf10f3b08f6","sha256":"61c8f97e4290c1b6e5cad7f1dc88316ceff39ae9f8c6473c8868ea010875ff11","sha512":"c450a3f851fbcbac100d40799f38953e4aec92a33769a82b806bd5890ab6002294ea3ca9f268915fabec44a6071d30548fc83f813705734f048c6649cae874ca","ssdeep":"","tlshash":"3670000000c0fc0000cf00c00030030000f00300c0000000c000f3fc030000cc3c3000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.387691Z","times_seen":1159,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"647fb2e887881e7a43e38681c7fccfff","sha1":"3aafaaa41604b57786f6c68f552b18ddbcc2e3a0","sha256":"bd46d9f7163328d6cfe6f1ffe092d73d4bf31a10b7c13afbbee0819760113b4e","sha512":"2f9a6b2d96dc4b348d66061119840555c162a72b650af7f677103c3403722b8314dd35102f624cd17dac6f8c3ad138c90d168336427de405273e14599e1d20cf","ssdeep":"","tlshash":"8c7000000000cc00c0ff00c03030300330f00300c000003cc00003f0030000cc003003","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.395957Z","times_seen":1162,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"af42124fb23866e29287836fff6d3896","sha1":"8417cd2acf7b2fb483102d54c5238f91da85deb9","sha256":"1f0008a619fdf98128a6bd9c386f8f8b41254adcfec1a1195d46009568c67b63","sha512":"509f7c7839b5b13e88812ba21ab0ee059f9d014ea4c7a5075fc06b2a77e4879cddb1f14e9daec9ba10661962fabba400a2a6a2d43bd7d272702bf925f91daeba","ssdeep":"","tlshash":"d87000000300c00000cf0cc0cf30000003f00330c3000000cc0003f003c000cc0f300c","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.440041Z","times_seen":1115,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"729409264fc1bf2874651a3c16ed3ac1","sha1":"744d4edbcb9de5287abd15da414ac712e4ba7dfd","sha256":"63370806c302182c42c242c16817f18c7d204507c31a32957a241323a667b93f","sha512":"8fcf93166552d5f33e402fc5b1fc57a072ffcc6350e082e3079743c1f4ef9c4dcbefbc2686b0e424ead208d323d0d1415b4ef645f94fe3e5dcb8d1b8d0df6562","ssdeep":"","tlshash":"4e7000030030c00000ff03c0c030003c00f03300ccc00000c03003f0030000cc003030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.404188Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"c2274bf4d3d8c56c24099c9c6c922129","sha1":"f9ca14e62356c3d1ac19c1cfbaf96bd721bcafd9","sha256":"da55c710a4bfa6102e7212e9685e1e6ca6072de478b9b5a4ef73fb629043b9f2","sha512":"5b98acfddcf6c7700219b2f584de898054fed132c0f121c6dbb0a620299de9e832ec621f3df038d9d2790ee8a8864836607018c4930b5a07f52b9933df1e6b89","ssdeep":"","tlshash":"fe7000c00000c000c0cf00c00030030000f00300c0003000f003c3f0030030cc00300c","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.40521Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f878e8bd0445ab90e42c6ff26a714cd5","sha1":"cef4addbd9946a09aa2545fea536b580e5aa75bb","sha256":"bd2a6457dcf585698134e31288339b2c83c90bc3efa0207082c16f1947d81698","sha512":"1d8724433f59637b18e6a2a1ebd24a3f63f1f2cc7a3272205d29b149225865449bde74a7b80eba897d79d273e6cbe64207878f0a7bc8cd9ed42ccaf87a75608a","ssdeep":"","tlshash":"e67000c00000c0c000cf00c0003c000000f30300c0fc00c0c00003f0030000fcc030c0","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.389274Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"6a1cc42d9ecc09ad04c6b7f1ed9b6f7c","sha1":"0addfe6c569b463fc78a85f1a000f46141678101","sha256":"06f04bb101ca5086aa7cc8625be865598db47cfeadd30fc16d8198aeb100cfff","sha512":"83e4dfe51f33f34b4b3a9e04950ff265a1e63ab35d7601645a810f49f060e995c55159f99c1bb7406052cef4b4b6f8ab1bbd987b8cb7c993ef8eaff06c8ddb99","ssdeep":"","tlshash":"b27000000000c00000cf00f00030000330f00300c000003cc000f3f0030000cc003003","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.431059Z","times_seen":1161,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f647cf4291b3514acb6dfc5903620806","sha1":"77b87aa14c8a186cbfa31490eba508307ea1b58c","sha256":"745aea14ad1731fa076e2e237af3006c8c7a0ed94379ba01dbe3abcd0947efc4","sha512":"b419afcd49f5ea3fa17054138528545eb2e18f90df61ed0332b640d1004b36616a2d1504bbbb9667ef76f3291f61e5b47bfd431db9e01c38b540b02adf27fcff","ssdeep":"","tlshash":"6e7000000000cc00c0cf0cc03330300030f00300c3000000cc0003f003c000cc0cf000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.397035Z","times_seen":1163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"ce67180f52a4e213b02a73de699ac9d7","sha1":"406af3ae3db036d5e0a52bced3aa8502371a4cf2","sha256":"49b4dfb6858a942ac006505cb2511424617ae6f26d173aa2363f1128e32bb503","sha512":"611665a65144ec32f67bef90ce76a29c7307da770ae065743d3002a0e03c51054f2dc9e5a5850d6679ad016cb8c6c5431fca6fc799bad36e2c24606842ddf482","ssdeep":"","tlshash":"857000030300c00000ff0cc0cc300cc000f003c3c000000cc00003f3030000cc033030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.409963Z","times_seen":1105,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f2f9eb963a5bc112561501b10eb9f688","sha1":"e7be8ffd6bdc4082a2c86b83940f291ddee8cb9e","sha256":"eb6d59fae5702df6e19944401b185d631f495acc6a1b27707bc524e4a26d3768","sha512":"20c4618e3e2878f73570ca9234390eeebcd6ff84b2c6e3041fd8d0c83cc0c65e62196eb30d97bfeca2a5cf04adaa55d389c52ba7f4dc5e4152276a58e25f6ec5","ssdeep":"","tlshash":"4a7000c00000cc30f0cf00c000300300c0f00300cc000000f303c3f0030000cc003000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.421928Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"2ff07b7af9c1223cc816428b9699a077","sha1":"2f7744b74e67feb8b4d37fd68c5b341e657a5d09","sha256":"947ba6e211b46fd494a831c93774e351a2114a2068306ac8137023a29c22d717","sha512":"04a6f8e6e88c4f7f7b3cc57f919c0751dff1f5189891e1725aa6373a72bdd597926cfda9e736de4ead977c6b5ce585b42c204b5c4bfdb59f7202aa5c1358d0e4","ssdeep":"","tlshash":"f37000c00000c00000cf00c00030f0c000f00300c0003303c00303f0030030cc00303c","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.410464Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"3b7cb9e898b2368382615803a65c75d3","sha1":"60fa902993681d254fde4c6066be68db74de2ed3","sha256":"38dfdd15caf30f9899d49a6422b73018cb552f873de5dce24d1c2bd01a72c888","sha512":"025b1331e59f60815a6bf4e0ecc18ee6a3a10fab697265e9acd05509478d5006fdc8fe9bb288e58e89fe5d5f8e1a79c2b2973711d5bda0b70ac68eab41b1b324","ssdeep":"","tlshash":"e870000000c0cc000ccfc0c00330f3c000f00300c0000303c00003f0c30000cc0c3030","size":19,"data":"","first_seen":"2023-04-22T10:34:07Z","last_seen":"2026-06-06T02:23:39.4295Z","times_seen":1137,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"fccb11dde8a7d3a197ba6dc22fbb231d","sha1":"c86b853f11220a14d0a667bbe08be97d18679fcc","sha256":"f37b4e527dba46d6e9ebf512a36a060780533a164c538b67a259910b79d96125","sha512":"478a1000872e5cbf4ff6b6df095d21975bbfa4994cfe50e33e24258ef57b001a8222f9352f0dbd1172b258f2d015ddef700bff73d5bcfae09a4543cfa303f464","ssdeep":"","tlshash":"897000280020c00080cb00e00020000800b02300c8000200c02083f0228000cc0030a0","size":20,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.430056Z","times_seen":1139,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"db0a49341fdf4c15231eac4c984768eb","sha1":"7f672147079f45765be2a5aa1259520ac55d5187","sha256":"a096d07cb4eb3f9b68c17cb876dbc2e067c1092e38dbe84704fc00b1112b5530","sha512":"a5398f33a60988ff68eff961ead7ec27f66bcdb464f2b27d8fecc05dd0a8f578775f2c18e3c2226d5ee87592ea086d56f30bf93f6afa306e033fb8fb4aa81589","ssdeep":"","tlshash":"a47000030000c00000cf00c00030003300f03300c3c00c3cc00003f003000ccc003003","size":19,"data":"","first_seen":"2023-04-22T10:34:07Z","last_seen":"2026-06-06T02:23:39.427831Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"fcf74b4a77f8a18258dfe246846fd85d","sha1":"4c9f24c70f5d69ff80690a78e47f62c2ef9b8fff","sha256":"7a519afdf92bd1373c0aa3900c6c455811f624a070d68cccf5da124e6579f54c","sha512":"dc827220ccf2c5ec3426f6a80bd9fae99c5659bc936d2baa4fba0b9c07f6bec8664dd0e0809f6221ddf4251b3f278ad7e71b1e4a9b738b440773acd1eec295d8","ssdeep":"","tlshash":"167000030000c0c000cf00c00030003000f03303c0fc0000c03003f0030000cc003000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.414696Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"d5d4a03bd7a18c5386526c4809b986be","sha1":"cd8ee075dd8b9b45e44a1f294a363189d12c037c","sha256":"c391d5c8f3478b12e350ffe590cc18b8b53b7c0ace33d1ebc9f6a91f227515bf","sha512":"05c21e4dc5fbdcef8539e41596a5bacb6cb8d2641673920d9dc9fd7e7a8f00e221412b7e8f07b4c486f1b14ea0d0b46898fb521df9fa586e03b0c2e9bd03fd8d","ssdeep":"","tlshash":"d6700000000fc00000cf03c0003c00000cf33300c0c00cc0c00003f0030000ccc330c0","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.44363Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"2ae35f56a615f14d8728c7874404207c","sha1":"b41cbe47fbc97c9f18d854d5209e0871beb5237d","sha256":"a6effe7a48b7aaf9b0f0efb65395e3f6a3a0f74703508a1190c62eada4a95ba0","sha512":"b9c5391f5b88e07903aa418990a8c39c606c2c8e8f025ef762b91fb6aad3b3a180817e7ce556cbc005e864c2def8bd8a38efb449e3b8d459ebcd91f74779204c","ssdeep":"","tlshash":"0c7000000000cc3000ff00c00030000000f00303c0000000c003fff0030000cc003000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.41971Z","times_seen":1161,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"6a0f475b9036eaf5ed81b8fbd3723157","sha1":"ca0eec508471941b33160812e50112521f27f317","sha256":"f552df46f9705f908d8c238fa31da2a9343a706c85c0d9e318b0f1ff3b82fc9f","sha512":"41735bf2674e8a77daecd6401ca8a7aa2e0dcb88d1c386965dc7952c0eabf6698f5aa87f37471338c92d3b67fb72173f43b06c09b1cb4783933b4aa016245411","ssdeep":"","tlshash":"557000000000ccc0c0cf0cc03030300030f00300c03c0000c00003f0030000cf003000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.42346Z","times_seen":1163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"fb95a63e798bbc1c52b2f422cfe52052","sha1":"03786e47acce519416eaea6350a4488f36ef2edd","sha256":"383ca780d1ed19d7c3b4a02d2b928ef255554880c51ee3317b58974bb7ba453f","sha512":"305c63fc47c7008d5f450ca05f6e575c4854405c550733b254c08b4f2f5a383e28dc2cf0519b0c987aba81d70c110a9bc77d3fee852799608c2d80d7f4cbddcd","ssdeep":"","tlshash":"f37000000000cc30c0cf00c03030300030f00300c00000c0c00f03f0030000cc003000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.392334Z","times_seen":1163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"680fb8d8d22989bb18183258dcdf9f56","sha1":"57474cf81ab39e5b093493d0c35d048cbf466fb2","sha256":"2e2f7a853d7480bd50d7021551e427eadcf5e7814f07eaa47ee2542835a512c3","sha512":"7eb04dfb32439f24cc67ca37a6b2f9349bfa96f271a5e33f54336497a2bdb93f3528d2c1221a387f1cc4a2b2a982a48b313d3a84ee454cea5c9a42368e1166c7","ssdeep":"","tlshash":"0e7000000300cf3000cf00c0cc30000000f00300c0000000c00303f0030000cc033000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.440825Z","times_seen":1113,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"1f0abd9d8e8190ccb8b56268b03eb97a","sha1":"852e909d6d20f5672428502ba0541fad7f0ee2c1","sha256":"a14c6fff6bca9d195ec25fe83830d69768fdb69b0fd1488e29cc7ba00ca04755","sha512":"7d8b11bb30b489f3247b3566fdc6655be78ce35914b1cfbf92f0781be9d349cae704d45c1a872c9edbde2d30d90a1926e18c7601951fa3bf26f450f3fc9a36b4","ssdeep":"","tlshash":"617000000000c00000cf0cc00330000303fcc3c0c3000000cc0003f003c000cc0c3000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.403133Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"e517ae48d6a82cefa2de65e88b6f5693","sha1":"ca25ce518f711726cb813ee73efcddd79211e1e0","sha256":"169ebb8cf7ebcc8b8340edea912177a118a79c22c031852b1d412cffd13500a0","sha512":"3cb5a380419a0579d6422350ade0ae728ccf8cf85be361f7fc9d0ad27e695e581e712f43330792e46c144a0c7b3633313795ba7e988bbfd08208bd0880d159b5","ssdeep":"","tlshash":"de7000000030f00000cf00c0003c000c00f30300ccf000c0c03003f0030000ccc030f0","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.428389Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"2411b0302e914ba65e0fa282ccdb294d","sha1":"7665ae057c875df2a3b5627aed7505144d01ca47","sha256":"dd6dc2cae94ee25ed18e37d5129912d4b59c065c9b4544948d80bd1a090d1f26","sha512":"e2144977c5cc76500630ca96ca8fa541941756df32b7269cd6bf2b280084afd9e8cfb390c079044b5c6a9e34a433f9bd3b074b28b70ef0e851d1f524e288e7fe","ssdeep":"","tlshash":"bb7000000003cc0000cf00c000303c0000f00303c0c00300c000c3f0030000cc0030f0","size":18,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.381929Z","times_seen":1153,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"6b917a41c9ce27526ca480713e81d2d5","sha1":"765c462784fa25ea41d89b454897d227b6c9c63d","sha256":"f0a7e368791613d36120e33ac4525e01c01d1c007fb79a454e761f4a95ed0d7a","sha512":"4d2c9b097d64b6ce6ddfca436adf4fa1fca59e53e6303571876bf285d597f3c64e256a9b43afaf59106a513eabacb5a8740440edafd49d8a047de1dae701a54e","ssdeep":"","tlshash":"cf700000f000c03000cf00c00030000330f00300c00c003cc00003f0030000cc003303","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.424006Z","times_seen":1080,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"9268bb720f57b661570d77717fb1cf8f","sha1":"b9a950fd874919ed5bb11d31b42cc036b1984ae1","sha256":"e4d50938965686c89329c9f3f0f7b67f9d183ac06da98664125994353784e4ed","sha512":"7afe9117e1e394cf14a6943b3d38112391d6af85c6923f4bf4e92d990c9a6659f9694673a5655db8c2420ce0461e841fa46daa828f6cc6d004f4d7c311fba211","ssdeep":"","tlshash":"50700000030fc00000cf03c0cc30000000f03303c0000c00c00003f0030003cc0330c0","size":19,"data":"","first_seen":"2023-04-22T10:34:07Z","last_seen":"2026-06-06T02:23:39.420822Z","times_seen":1115,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"b6dc090a79226495e9644bbeee756518","sha1":"449b67436c8785555c781956ba56a454515682bb","sha256":"8367a78ccb1e3cde37697b3af2f117e317393718fe68e566e6c13ef210dcc66a","sha512":"b846940ecb72d97808d5f1109f2b04c7ad24266490bb85b416b34b7ed607c09b58a3b73c2604caee225302f1978cc3d7f77e9cb786501c4fe173c5e482ebea28","ssdeep":"","tlshash":"2e7000000000c00000ff30c0003c00300cff0300c0c000c0c03003f00300c0ccc030c0","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.428942Z","times_seen":1140,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"c03b9a1c6d2d1376ab7110b920b5d11d","sha1":"bc7832ff98ec68e189cd59bdac5faaa8cd059747","sha256":"ee40c4a368f53c7893aff3c16c8ac59dbec639ee5bcce94243e05aff45db1089","sha512":"a47089e16195d486038c9931dfc79e71b305f5fce1b8a9e8833d7c4b1a4a624800820afea5d86913fef30a484a13fc3810472df5ed28ce0ecfaa9ea68a758e6d","ssdeep":"","tlshash":"107000000030cc00c0cf00c03030300c30f00303cc000000c03003f0030000cc003030","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.390286Z","times_seen":1162,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"d90560affe7012b8f8e4cbf45b4ca9ce","sha1":"6cf02cda967c64f7b85bcfde72f88c7c53623f38","sha256":"0a0204c41ed0bf5389f077f49cfda3e0acbd1a5941414f8c0fc74ee91aa81581","sha512":"6d2e8440ee6619970f1bcb5c47f3eb2e4ff5a165df28ad2f575abcc907550aa87b03f690a85b6eae7b74c5318faee536200d903c48e4789f67f68918062da183","ssdeep":"","tlshash":"407000003000cc00c0ff30c0303030303cfc0300c0000300c03003f0030000cc003000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.388243Z","times_seen":1161,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"76329b4f309ad0211bd98453fff68ac5","sha1":"50bf5e047121af855a3d42a222c9143d86c8d091","sha256":"b02a058152f38597d83528c997017bb74bf95d4eed4d224883a406a4db4236a6","sha512":"86e58743956467fe7d04af40720fcfacfc6c455cf7d790945db1d9db3b59530291b2ded12f6c54fb86be047f31e4c88cef782d25144ddd6bb6a63e03f92c2d49","ssdeep":"","tlshash":"20700000f030c0000ccf00c0c030000c00fc0300cc0c0000c03003f3030000cc003330","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.37928Z","times_seen":1176,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"a1c6b372448acd4925b2d6d2ec1a69fd","sha1":"93d1d5fade913b71328130aa3bf7e11621dd7620","sha256":"a47fb74d2df6ec243a96b3afb0a02569398d11e82a11d77acd303fe9c2ac83e4","sha512":"0c27a42c6ade1cd6443fba3829a36f40d366ef6cb0beb8f2002ca1726f6e81c0b1df64a0a08b5a61098b6bd3b46f888b27df00243f694a85373a4b23e381ecae","ssdeep":"","tlshash":"8f700000f000c00000ff0cc000300cc000f00303c00c000cc00033f0030000cc003f30","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.374956Z","times_seen":1080,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"246541b0664433f23212b252305bb32a","sha1":"0866efa92eb7f9c75b3a45856a9c7e3310719b7d","sha256":"d056a96cf6d509c9def10b7dd78a46fc7b137713344e804ed849f9766c57ad19","sha512":"c1349dfaccad1b657deff3bd9329f111398235aa9cf2519526ff671203599809b733bb470379ccaf0afd2688041c421484966ade58f1ffde4dbe30bc28da3431","ssdeep":"","tlshash":"017000000300c00000ff30c0cc3c00300cfc0300c0000000c03003f0030000cc033000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.409457Z","times_seen":1105,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"dbca3d0c2e30aec4bb8135129e26071e","sha1":"c9e1cfe63d9ca153308d08d009b38f5281ac9073","sha256":"39e9000d8bf5dab29600ed51f277c601b33e2950a545e583542b9bd68cb9b1da","sha512":"5cd62ee6a5a51902cad5e230e616dbfb9b1765e6b0d981a8a94b9f33cc238af64c8d54b2e4fb92ba0d1008ccc2f570821fae447c400b8170668050fe49d5781b","ssdeep":"","tlshash":"867000c00000c00000cf00c00030000003fc03c0f3003000f00303f0030030cc00300c","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.376039Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"cac42769044d0dbe5b683086ab70007f","sha1":"451bc1076e896baf8c00f8c311abbd65f85d50b7","sha256":"7559e26f738b52c0f790444412c346745de4d13ebb8fcc28884862560cc9519f","sha512":"faf3d66955fbf279d054c7dbe0dfe116540eb7aa7e936aa91256810a1575504b10cc16dd0bae43036fd258d7e45b5b95dc78c9be951d85ed953c97b05676d0f3","ssdeep":"","tlshash":"987000000000c0c000cf00c00030000003fcc3c0c33c0000c00003f0030000cc003000","size":19,"data":"","first_seen":"2023-04-22T10:34:07Z","last_seen":"2026-06-06T02:23:39.390798Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"709dcd1b74993ea1d86ef30bbe75bda5","sha1":"49c6ebfdbff7a45a3af735dba2494fd9ab107b17","sha256":"4ad9deee352fba0870bc0b6f55370cf953f8a042e00c7ccbd3bceb16592f4df7","sha512":"c8dec8905a9450b9946ef6fb015313c8151828c304abfc03d00f43fa811e72c40fe57fdea7ad8d9a10488773240d88764232ede6e51e0f8150443a56ebf80ffe","ssdeep":"","tlshash":"9970000330c0cc0000cf00c30030c33000f03300c0c00000f00003f0030000cc0c3000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.404699Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"a9760db6ce462dc40062b65a940fb027","sha1":"7d6f111c75e4d5b4b061f8c6c81692883e80fce8","sha256":"a155a9d1fd9ba999b8a5e384a89513097831bdfcec72082c4b7d8dbc74439af1","sha512":"39043af135c03ec7de880b015885544057d9025bd8946223ff960a53f2c9542cd047a2af08893334d158dfe2be0baadd64c3203a546f7b6afb3a1bdb6f6ebaa3","ssdeep":"","tlshash":"e470000c0003cc3000cf00c0003000030cf30300c00003c0c003c3f0030000ccc030c0","size":18,"data":"","first_seen":"2023-03-12T16:21:53Z","last_seen":"2026-06-06T02:23:39.419161Z","times_seen":1164,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"249ee03bf7db43c6f29e76ba6404b78d","sha1":"9b4125a177d266bfc1519b6335a3fbda4d67c5cd","sha256":"3956d7cb31e362559ca075d5528bec5005aee524c51a9f77cd9455d3f41615a9","sha512":"51185abd97f31e023d4cf51144580bb51c4c0230021e6191affe6bcd0972493c3c663ddb53d6bfcd452d9c4b09f93952799c4f7d55339b8361113dbf7ef24e8f","ssdeep":"","tlshash":"997000000000c0cc00cf00c00030000000f00300c03c0000c000f3f0033000cc00300c","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.430637Z","times_seen":1161,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"37964c4d9cce527dcb1ac8b7c24a3786","sha1":"5338666ec585469c5b572b68d3927bcca80fce09","sha256":"9fc0e0126edd39b42528d8f8851ffb1275b8cb9db15548041fab20c581d1b070","sha512":"b5d3858e51822eaa9c22e867c69be0833b079e1a78b1b89081fcbc4485d2f397326246dbccce5433e9257a0b3f42123652f4367176de745b94ca93619be69703","ssdeep":"","tlshash":"45700020000a880080cb02c02230200022b02300c0000802c00003f0020000cc023000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.396535Z","times_seen":1161,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"d376a619d339b30958e60e92b3613146","sha1":"28cc836bf9fb7b587bfb4b7159862e2adc8d432e","sha256":"ff4ce15fa895a6743337778c3a010eed23f7ffc99a2c50f64ccfbd6ca4e76dd1","sha512":"831107c930076ad9ea26c88529a8e5880280c768b5a88ae5a39243b051d256c860bc443734f82e086853b1faf89fa9a7179faf8842db03be7ca8bd54cf302159","ssdeep":"","tlshash":"8a700000f000c00000cf3cc00330000000f00300c30cc000cc0003f003c000cc3c3300","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.383476Z","times_seen":1081,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f82dff41574b0ddcad47c145b0e28050","sha1":"a2370f27ed38a5fc1e12ed4711814951c6926b1e","sha256":"db847cb68230ec9117bd8205a6aff20b71d27c3eceace3c765b22f92653cfa83","sha512":"a9b9a450285cd47fc80e0d9dfc2724937f42e4080d686224461a6116525360a8733c2344c0d836ca86643a972a2209232fdf9fd656435d07320414175c845501","ssdeep":"","tlshash":"c77000000300c00000cf00c0cc300003c0f003c0c000003cc00003f0030000cf03300f","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.426725Z","times_seen":1108,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"3a3037c3b96ff0a3193bca0e7f88aadc","sha1":"76a57d086b2730b9f8ed53d9d436cec27afd6f25","sha256":"427baae29ffa2912b54f3efe7289d6feb962258dab66f3e66fe7f97a74c05781","sha512":"7816d8cadde05ab305d89cbfd7942d9bd1cbf53c42ee1e8ceb55f365fa0a96f4872973ce2ee0e6ce106811e44c96cdcedff2f0a261dea361130b9efd6f351859","ssdeep":"","tlshash":"777000000300c0c000cf00c0cc30300000f00300c03c00c0c00003f0030000cc033000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.413549Z","times_seen":1115,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"c64569b31d5a228f032c7af0dbbb959e","sha1":"e73d60cace93a0fba385efd2dda2fc91144b857f","sha256":"faff0e661677302655ef41c0fbef9c2a414473eb4fc91717bff201e5d58e311c","sha512":"5efb141ba1f51e65821fd3476d2ca7f73ec11a7aabf1cb3ccb2d533372eb742f7f49f24324e6ce044e5364558c0cb8aa41d6853ee07b30a055c1f3c8188dce0b","ssdeep":"","tlshash":"187000300030c00000cf00c00030000c03fc03c0cf000000c03c03f0330000cc003030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.375472Z","times_seen":1139,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"2407ddb62e965883f20fa23c826bf328","sha1":"8870fbad82926b2a51ec8f4d96b0dea661f54d0a","sha256":"87484b3dbb15f32dfc8952ebd6b9530b83bd03c1693c2c0a870db80921c241a6","sha512":"782f1536b2910e0a2aa1400fdff8716039a5fe468b99cfbb3a1d4ac342bb07a9285cf69eac395392d330c8dd044f887b017c3fe0b5c6a818636146b6c1cca1bd","ssdeep":"","tlshash":"267000000000c000c0cf00c00030030300f00300c000003cf000c3f3030000cf003003","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.405779Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"22e39ae49f7a49a8c6ac9e9a426a64fd","sha1":"73706b4bf4bb0e76c3bf8edb7852f248d4e5e91b","sha256":"08d0469b8cafe434d317480ce41859356a91804de4d8fd6243a7068d7d926524","sha512":"c1e00c5ccfb523889f974a7ef4cc3adba70540f84d64a37d31ed528ce412ae52e88f10b1928cece8fa1f1c9ca6e130894ebe23b845744b62f2f1532bef54cb0f","ssdeep":"","tlshash":"377000000003c00000cf30c0003000000cfc03c0c0000300c030c3f3030000cc0030c0","size":18,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.381413Z","times_seen":1136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"b44ff8f68d1f8325df640a60702c18f6","sha1":"38b8117a575001fb06f9a0ceadc55228ccdce7b3","sha256":"d6465167999520a23127488c727ed47123218b0418295045e7fcd628039c0b31","sha512":"eefe2e0a86b14485ce7ba1ce2f135bfb0db342df99b8060ee33e16b54df58f23f12da0ebf6f1f50b770d3e8304a42ec91dd49489bab7f4b35dd62aa55b6e32d9","ssdeep":"","tlshash":"6e7000c00000cc00c0cf00c03030300030f03300c0003000c30303f3030030cc00300c","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.411954Z","times_seen":1162,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"d3b57cc7a3f68972d1d815b2b7c9d262","sha1":"d753b0fa88877e503d25cb2d4f84a46b742ea90d","sha256":"faf7526df94ba09d8201c854b3605295bd6c991b47bf736166a418e3f86ddf7d","sha512":"d7d485d7e0940479b9ba585364eea0baa6d4fb2058eafe38012c8395c1ba5a146d689752414d9ffda3c0301a22246eb83dd2afef3f426e88ae9f63dc3f4c963b","ssdeep":"","tlshash":"b070000000c0cc00c3cf00c03030330030f00300c0030000c00003f0030000cc0c3300","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.412517Z","times_seen":1163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"53c240fa6885652da29ddaf4dbf8c505","sha1":"ed8d6bbc962db63b8e7c34225a0f0698ba2119d1","sha256":"35567e82ee7df5a7386f8ca0a1e6b1e67b0a2e3522bc94ddd21829e6711a240e","sha512":"aec41e89bbecfc4f58fa42372121188892d1137c64c657ea6c108ed28f67f7f4612ec0fe15fecc1f27c8ec80c4eececf5bc66af8e7333420412c2e8cda9c023b","ssdeep":"","tlshash":"09700000000cc000c0cf0cc00330030000f00300c3000000fc00c3f003c000cc0c3000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.386596Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"596e6606d7c4ede34de2935f3c6c187e","sha1":"d3ea84761e98142b91559b1a922cea287a5a3011","sha256":"a6171bc58c97c84152bf23c4cd548779070196e84b8ac898f0c3f6c573bb372d","sha512":"11ee51f329da90ffee3848992b6ae5552dd9449e67ec5073fd344c7c801b1a52a4a3debec85f38b7479763fe82b0a55b6953fe98d593e7ae83dbe8787f91fc82","ssdeep":"","tlshash":"1d70000000c0cc00c0cf00c00030030000f00300c0000000f0c0c3f0030000cccc3000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.380377Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"ce5b835c74307454b195bc9b87ab25ad","sha1":"6e2a7143cb9d2f1c196ea81fcff842aa7ad2bfd0","sha256":"2bc85f2a21ff1488d409bb7549110022cdc2274fca518696103e6ea4ee971392","sha512":"94af6846f0e4afded87dbf8a89fc1a8900aefef1bf4bedac2e292b749eda6589fcc339ccafa613409ed4c69d6917b6b2e9e7de92fc72238699ca287911f119f6","ssdeep":"","tlshash":"49700000000ac82000cb00c00028000000b28320c0800080c00203f0020000cc8a3080","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.39173Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"7b777c8258be4d66daa963d0851338d0","sha1":"7d3e13bc46e3ff6b2d1365e2c51b943b6b250f5b","sha256":"690824b051f1ae8815e995f91232422bdb859066dc36605eb3d5cfacf604c908","sha512":"6c1214626f9160f0a0210098b8f658f8cb42ed3c3f7a8fb6e67acf45a10779400a56c51c03676269320ef27ccb2669ca4545203b5c539356fa33bf641ad47dc0","ssdeep":"","tlshash":"b470000000c0cc0000cf00c0003cc30000f30300c0c000c0c00c03f0030000cccc30c0","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.425644Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"c27e5c2ed7c9bc021cf46027c8d241a2","sha1":"251315bfd44456a07441481d1c9b3fc811f4aa3a","sha256":"0870b6fdcbe4700c7e9c7c316ad592e0dd191f78b472267d3946db8a8ecc8f21","sha512":"5ff6722c22fdc3a20d9f01b1d466f99779c836e841e7f4551453434bf51ac7e251e19433e907a757a77e08c9a99f050563c9526c277447bd0f209ba84477f09a","ssdeep":"","tlshash":"29700000000fc00000cf03c00030f0c003f03300c0000f03c00003f0030000cc033030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.422898Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"54dadabdb14c173b950fc5ac0647dc61","sha1":"100c82bb931eedb7fe034bbbbf0c1373cbef348e","sha256":"1d8d74849c3855d65dcdf22c44407e3b34d34279aff0b991e24c5a08a8f62b07","sha512":"06d0506a57fee7281352046a4baa67d418dfa6fea6d4ea8837d61b5e5d14ca5388d5b38a5cb4c59c562a70d5cd9177725ecb8d06846c3f422b1124e9d262be6a","ssdeep":"","tlshash":"cf700000000fc000c0cf03c0003003c000f03300c0000c00f000c3f00300c0cc033000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.383993Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"3e0783099007df1ed28a11c3e447ea74","sha1":"01fa4d2d862c8d4cec527823cea2028de9928c5f","sha256":"afbd1461a80f657118dc4824a30e2604804026fabfcbe6ca2ab93458a53e8a82","sha512":"14c544dae3baa5f2d7016724721219a19cbbae2db8882cc64c0f14ed37eb75dab6cb29f8c920c6b9a468785abc6d5973b1fa79d4d9971c17f9368e3c35b4caf8","ssdeep":"","tlshash":"dc7000000000c00000ff30c00030f0f03cfc0300c0000303c03003f0030000cc003030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.394475Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"4999933195d7474661a7588a5ceea991","sha1":"a10e2435d00ff565b423650e231fc3a7ab060671","sha256":"0bd8d756a5a5967d29f7675f3cdada4a6b19f54af7e23e9b62fdb386b325d74e","sha512":"79a788a952b8bde04383a9e7d35a7fac850596b206382beb7a8fce64a7cfc1f2e6ed7723f8a83d6569d1f95fd7435b23d31df0535c1827f9f46bce6078219b8b","ssdeep":"","tlshash":"697000000000c00000cf0cc00330f0c00cf00300c3000303cc0003f003c000cc0c3030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.410979Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"8eaf4d081dedfc08c187aba7541c733d","sha1":"31db4de8047c65cf3f13398fa2a6370d9bf24715","sha256":"fb1e251f69d755e669e5e0207910977ba8bec923abcd0c264331da8ed4bc5de4","sha512":"e532054cbf82038f4115f8c1de3c940abc30196071e5305978cc9d35527779a65249b8f6b76bae5b69ca514615277582115e2b2fcb1ddaa186182be65ba52917","ssdeep":"","tlshash":"d47000000003c0c0c0cf00c00030030000f30300c0300300f000c3f0030000cc0030c0","size":18,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.378294Z","times_seen":1165,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"162f95de2178cea10bf79eb715e4d3b5","sha1":"0ac1048b6863928b93acc3f91cda49b162326c20","sha256":"661cc1cfe956c3e47afe43542b0956d36df0967d344be3a5abc13daf7f6f9646","sha512":"3ccb936c27af9f0c47ee2403d14551ef6274a514c15fdf816235be81f54755db6d6262a19448ec509bce35e5fc9492dda6c6029cc8243a9eb87bd17061239c62","ssdeep":"","tlshash":"1c7000000000c00000ff0cc000300cc000f00303c000000cc000f3f0030000cc003030","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.38721Z","times_seen":1164,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"104eaaec377fb78d0b1478984f38f3d3","sha1":"cc4f020560b23626807ca4c76f343b81602c2d1c","sha256":"72e9c6362d28cbf9388242bcbf0459073706e7893281cdf07d314bcec18b69ee","sha512":"0c4330095c4cb24ace162b4c3fbda8cfc6040166cab6b168e52d93e75a73355129158311ab3a368fc9054c9decf4d98dd9a791af430cbbaa7d7368c61d4b6707","ssdeep":"","tlshash":"59700000f000c00000ff30c0003000300cfc0300c00c0000c03003f0330000cc003300","size":19,"data":"","first_seen":"2023-03-12T16:21:53Z","last_seen":"2026-06-06T02:23:39.416936Z","times_seen":1173,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"e4c7a3c9e72ec837c02a88cbf6b7a80b","sha1":"0444c709587d095566e6bebb1d03c22291bd0784","sha256":"dcc572e88b89cf5f1e285e3ecdf898574e421fcdc7edb5e215a334161e7a23eb","sha512":"c779a1cd14a13e9171ce59fec3f728e3e896e6527a35e041c758b215a964243e8cdc901dc36d1f1c14be877ea410e571c095d4dab75f9f13c03b09f60a6425b4","ssdeep":"","tlshash":"ec70000cf00fc00000cf03c00030000030f03300c00c0c00c00003f0030000cc033300","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.403671Z","times_seen":1081,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"d29638340b860a0169f2c6cbc8dc9e94","sha1":"2dda54c8164c7e88101cc3f8af0464102035e38b","sha256":"21049af0b39201d5e0689734e95ddfa2a20244afeabcbea8cd9fc4de8c8bfef9","sha512":"49aaf5c2aa53b18ab4ed50eb490b1eef7b1cd89b0b4fb3d016cc91bfee606e39575704cf953f9aff2ffc0154a4e9116047a82f3f09c50ba82bb732a1c636ccd7","ssdeep":"","tlshash":"a47000000000c00000cf00c000f0000303fc03c0c300003cc00003f0030000cc003003","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.373708Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"1381ddde79e03e1767f7819397700163","sha1":"bdc8e80553918ed9d64bf922becac723bd9fb729","sha256":"9b80a2abb7cef34f34d9c1b5f2ed4154352b8b4b1802b6fa3609b3c9d2b1a458","sha512":"256cfc038c118ad64df5cd0fd40a1c9c3b15cf689dd91e3f8c1058d062d928843fbd4584a53bcd47d3f2847e688a6e420e9c4e462f7beddead220c1c171e1210","ssdeep":"","tlshash":"0d7000000c30c0c000cf00c00030f0c000f00300c03c0303c00003f0030000cc003030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.418611Z","times_seen":1140,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"79c215027f08cd82c529a10402c8b253","sha1":"99e302dfaec95f521c1deee55d07fe431578dfd1","sha256":"6e6f81dd25c454e564a7dd6db3c735f45dbe63bc45aedfc18d6c63fa82b0934d","sha512":"58088a5766f6ae5f6cab1a8baf2234da56d9ae35b6591b0f51b50ea2c1a9c685966838cb26c2c1ca455d53cec6e2876e691baae9c170d5604f64f0724fc68119","ssdeep":"","tlshash":"497000000033c00000cf00c00030003000f03300c0000300cc00cff0030000cc0c30c0","size":18,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.382466Z","times_seen":1163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"8fc40ad6c73bea5a889fe64e47f00b8f","sha1":"cbb493e570ab2e501f3932563bb18efdeef3b2d8","sha256":"499654ba55a697b3ae5283cac5c035e0f9c55e1c887d2c53b8a9097857b65c4d","sha512":"82f81e389295414796c1f64624959edaedf897b3fe42e61033423774d5d271f7ae103b76a9f7afd6460033cf875c735a84d41a0a00b60cc05b94985f23d5fba2","ssdeep":"","tlshash":"b77000000000c00000ff30c0003000300cfc0300c0003000c030f3f0030000fc003000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.374327Z","times_seen":1165,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"d04ea7f0b92f18997d7780e97ecc7005","sha1":"46147adf20a41b5c1b52c5f72e9204dc76ca23db","sha256":"360fa8d722755207a3463bfc054ad79c3c49db3d6062f57977f1eba3ce662d58","sha512":"38187574d19d2a12d968c8e5e1737513fae42cc0dcd060b95dbecfe2387bfdace3f31c97b02cd6d7e72cdf59522bab394081b241e6f68a2e057c9466aec58141","ssdeep":"","tlshash":"357000000000c0000ccf0cc00330000000f00300c3000000cc00f3f00fc000cc0c3000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.411467Z","times_seen":1160,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f24fb692080af454ea0130ae04dc8273","sha1":"a434de2f9c55719a8bd7eebabfad3ba9d74f0395","sha256":"e7e4e3b9731b5f668a1bf28080a2908caa3c2c2e811ef8cdbb762c7fd226296f","sha512":"79977ff67e18cae680038ef961fcc3cc928b2c37bc8e39f72494ce655eb494a671a04771f2f531fbf151d32d7fc7000bb176e79db40aeab7823fd251dd4d4cfd","ssdeep":"","tlshash":"aa700000f0c0fc0000cf00c00030030000f00300c00c0000c00003f0030c00cc3c3300","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.432711Z","times_seen":1080,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"5d2dc822e8d4f0b306ca69e54950679d","sha1":"ec5cf0bb110d219d7e4bda5d14c0071c703cafd7","sha256":"374f328ec9257ea51783a844612b0d075cc7ecc70805534c0224f44adda5e069","sha512":"af8d84cbf0093e0a52753c419f82290b88aa4447ce835cbb5deb78afa02f8b7499b160dc86850d0bc7aacd72f6a5a8596413132a37d8786c5e4cc92637cb5ea4","ssdeep":"","tlshash":"d0700000c330c00000cf00c0cf30000c00f0030ccc000000c03003f0030000cc033030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.39871Z","times_seen":1104,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"4faba762a8b0eeda162b204eacb9c3af","sha1":"9b9ccf92f9811df1df8ea6d9d4cd650f8719d23c","sha256":"67a750f06cb8461db3c08f09cd4cb51932b8f99be5afc6e97b094be20ff17b45","sha512":"70e70ba41601a9fe1ec144ba99d592332ebfa2a4d4d9d79a555622155e0764be03d2d705df58c25380223e868e2ce5c84a44c54a95ddb69acf49519517d533ee","ssdeep":"","tlshash":"6170000000c0cc0000cf00c00030030003fc03c0c3000000c00003f0030cc0cccc3000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.417496Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"b463a44051f5ec20ae48196f36054e13","sha1":"5b732f6e972167e618e38cdcdf292c5a63dca9d3","sha256":"87da72b460eea48a4375dcf38b3192896a661cd64ec1465b856b81538f7e3918","sha512":"b235007cfb7764d3339ce0c489497814f37213734829dc2d287f9c56ba9134a1e9b1ab354e0c82d2d99311128207d05432bdb4b4ac36c9271bbb9b69f8eafb44","ssdeep":"","tlshash":"f97000030000c00000ff0cc00330003300fc3300c3c00000cc0003f003c300cc0c3000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.442035Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"57574f53b6de200174d35574df1da053","sha1":"2fb004ca614092eee28fc45611cdeca1d38ad065","sha256":"c990e04237a0fabc10c638a3340f0af26b4555ddbc373bdf453ff00910afa15f","sha512":"5ec41a4d16e518bcce4c65d4ee0a38bbb1b404239f41879331c7f9f778f874b8080190c132aad624fb58d0ce29de8d8f3aa7ffd7d03ea1ed1c9d386ac4039b60","ssdeep":"","tlshash":"a17000030000cc3000cf00c00030003000f03300c0c00000c00303f0033000cc003000","size":19,"data":"","first_seen":"2023-04-22T10:34:07Z","last_seen":"2026-06-06T02:23:39.425076Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"a33748764d90c55aca2d7c5eea289616","sha1":"5d61e51294395a77b6738e3a7f82be2478f9d801","sha256":"d6cbf00237a8151746b2ebf6ba332d9f62d6981fc2b717b63e7dc5e70e026c2a","sha512":"070c5524dc825263f91ea4105c025736e0dac1e279b3954369f8256a7f579db9253f3bb1452adbec670d6fa938edd0f12635c36e14fc97009daeb352f0484749","ssdeep":"","tlshash":"7a700000f003c00000cf00c00030000000f00300c0000300c003c3f0030030cc0030c0","size":18,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.415817Z","times_seen":1158,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"3c1546a94da3620e4978e2a646044824","sha1":"5308f928d39eb12a2d72472adb2be17ff63165df","sha256":"a00fa4d73a796073d56091271d0bccb0259527e76ab4a4174a145c41b4bf8059","sha512":"57e8224c6b737560edc2f6e830c0abb2be83dc7bfeec6d064805e88736466e6ab35a83a1b47f7417a8c8b167015fdd27f42097dc8c53df368930ef0c11bd43cb","ssdeep":"","tlshash":"01700000000fc00000cf03c00030000000f00300c0000300c000c3f0033000cc0330c0","size":18,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.408415Z","times_seen":1163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"2eabd15d7fb48764ad68da88149d6155","sha1":"d8a3fe7e022a7625954db8a68c259d8195898051","sha256":"7cd8d5733848900383d3a6998886c7cdfd5a57eaa280c916d7c39c84c91faa3a","sha512":"c82d9f451841bfcee8b64252d16b2f30471b0ba326df9e334f5cd1ce3267ceb43ae2a62ee411d8b584822a2ac4d1f99f74e6f6c6f11c383a3531e724609551ad","ssdeep":"","tlshash":"29700000000fc03000cf03c00030000000f03300c0000c00c00cf3f00f0000cc033000","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.408917Z","times_seen":1161,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"7a2758e340ecd0b98d3fff7299fd1893","sha1":"d62c034d608bd0dff30b756d7f4bc19bab964411","sha256":"967ad897643bf218aad6f18ba7572b8f1ab6d3f577b1dcbcfa82cc9deabedd47","sha512":"96ac99de4e50242ca218de5dd6144dea587dc6ce908df609b93b98c856c931ae3259268a8bc4f1bb793f0971a60988a59ce08250a0a4f705f982f4f875e621d5","ssdeep":"","tlshash":"f4700000f000c0c000cf00c0003c00c000f00300c03c0c00c00003f0030000cc003300","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.398074Z","times_seen":1079,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"3e8af7d0f5e6370da8570b377c888d9c","sha1":"c2de01f9d3daa641b9401c4e55770b1a4bac5b4b","sha256":"8ef50bb1bcd890c39e916c12f6eb9f1db9c08bf1e326342d1cc5ebaa4fe446be","sha512":"626a0da759cd83929530eb12aedb1a5f908cc44f57a516c6a5e1c766cdcd0ac7c20e29dbd1d441ed3c159d9679001a2f77a4ea7bde2504b3ca7051163dabb4bb","ssdeep":"","tlshash":"cf7000030000c00000ff30c0003003300cfc330cc0c00000c03c03f3030000cc003000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.427286Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"26b2bc4dfa81b43fe5a91d2c178dd361","sha1":"fd7919b5dda72e5dc5ff29f39439ed5f6ca81871","sha256":"8adcf28e1f74b9d284b6a8e7621e79f89ff5bb458dc81d9b366fc51bcb75f28b","sha512":"292f16a9750d730b3f5d2ba2847a423aebdb805686410cf8dfbfb228343e3db1d9efbc89c2471745e412493e4c7d796a2158e4f7b4a489d1af2e97b9c89f0d4f","ssdeep":"","tlshash":"597000000000c000ccff30c0003003300cfc0300c0000000f0f0c3f0330000cc003000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.44305Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"08981acc0dd5c00d58e592297ed2f12d","sha1":"6d917c2adac56ad56decf665139db8643f8713ac","sha256":"3e305db42daec26a98e6e0cf1a29a7c956a323a6ed1b0304409a505ebc7c5e1f","sha512":"8fdd6e777c8930635296eab251b9474342a23a3cb3eec69302bb16118e6dd0ce2dc2c81cf5a558c023081086dfd49cf356852fdb14124fbd442f77d7aece04f7","ssdeep":"","tlshash":"247000000030c00000cf00f00030f0cc00f00300cc000303c03003f0030000cc003030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.426207Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"8dc6baddfb887c207f2cfc80a440e097","sha1":"c44cdd6dd814762e2d52f58f72f09249aadf60c1","sha256":"7f97e2f5d8ac6458a314d609681f35979521288e3a0f2950cbabb8f0c0cad0c3","sha512":"f38df28f567e21ce58a2bb804f1e706b50dbf5e6448510ece60e7e2c36ecdb623dad712f564a8f9f88a490b695c952cf3968dc24e0df09f985c663daf25ebd37","ssdeep":"","tlshash":"f27000000003ccf000cf00c00030f0c300f00300c0000303c00303f0030000cc003030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.394952Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"ada9a1753b25fc846f70be907672be67","sha1":"62284959825518893b665ebea6b031ef55df7f80","sha256":"8e135684ca301e393371d1b6ecd56ae0e4012f5385a482770053ccea41476ccb","sha512":"a06ab12c7912413e05ef2b7789f7703cebb3953697c92931067e032001fdea3e477920f0637bdc692fd97b871751283654288cfc07b46512a794954cefad3f09","ssdeep":"","tlshash":"977000000000cc00c0ff0cc030303cc030f00303c003000cc00003f0030000cc0c3030","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.395445Z","times_seen":1161,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"d2708560ddddf9fe2854103ea6095b0e","sha1":"61af9e5b5b5e96580a7da75ebc27c57debb6137b","sha256":"6d013dfe3b7e6304821534f0802b91d7ecb34e69dc880ef3efecac06a14e8a78","sha512":"abf7d0253c13a28b55acf9f7ed685efaf639d70e888e7d3b4e3f26b7987f59b83bac1fbad72f217600bb8691e179f3edf910e82b9218201d9e4c2283a2813b53","ssdeep":"","tlshash":"a67000c00300c00003cf00c0cc30000000f00300c0003000c00303f0030030cc03300c","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.412989Z","times_seen":1107,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f7aae66ae2b52b128d01fd1b35e33453","sha1":"52b74544712d5ff9de4b1a5305f5a7a388ab6346","sha256":"519ac6acbff2bfb0f62eeec8219821a845f2cd063737b2aef9d4f2384fa6f733","sha512":"af43ca0a482d57d6f0ddb1f2a005cc91e25455fd7b1852986357dc5657d4fc4bb3b3a13682d8fa55b01ceac15857e8ec9f54294add4f7661b20dfcbc39f5c8ff","ssdeep":"","tlshash":"bc7000000000c00000ff30c0003c00300ffc03c0c3000000c030c3f0030000cc003000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.392891Z","times_seen":1140,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"914dadef0120224114573295cd60933c","sha1":"c4811ce68cfbc54e1eca2c2ba1af8dd6fbced84e","sha256":"c5cbce3172fffe2ca10ef64d85ba4b2ff52cf3989e7ba4a04b3024f50efa5f31","sha512":"b7cb7314338437d062c4f2ef28bc9cff735642a2069400433f888087d3c7eeb713267fffb8f1775fbf3a32c101bfec2479086acb8c599a3b06071d80d4604947","ssdeep":"","tlshash":"a47000000000c00000ff0cc000300cc003fc03c3c300000cc00003f00300c0cc003030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.393392Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"c063106f27cd1452ae135f642e53eebf","sha1":"47a5ba2c254149265ba308a7be7b39924ea90b2a","sha256":"7ce37963c8c42196e5562cd6f4804e4e7eb5ffb3d9393e0e8404bc55f6113cba","sha512":"648b8a67273dff0b5a04c9d760335b8aa48cade46cda4103f1ed56700f37cce7e0d7272e8f07ff6b8f670d2bf4eae2c94c8b4be0c5b07a80b84c2ebe3a9b59c4","ssdeep":"","tlshash":"aa7000c30000c00000cf30cc0030003000f03300c0c03000c00303f0030030cc00300c","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.376742Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f5799f97dd01d1b506b6c56d11b4b3ab","sha1":"24baa553dfea4ee7eea29c33ba5b62c8da6e62bc","sha256":"be90525374346d2f86a64dd1b13c775c34e9f7ed52f78543c308590d29336f24","sha512":"e4668a162a9ceda2fe22da9d46af0df8f2cf69d5c48ac5d5b020f67c1721530e14a660595201b92563e319f1aa90e2dcd09d033cc31df9344815ef3fa0c98e3e","ssdeep":"","tlshash":"4a700003000fc00000cf03c00030003000f03300c0c00c00f00033f0033000cf033000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.393906Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"b1b8a68909e47131052789e18ed991c5","sha1":"bcd0f3c9cfceb4a62dfddb168f3547b0ff706374","sha256":"8476c02876aea613cda596f888e3e454d1aad05d221a3d45f3a60ae9393ed319","sha512":"eea08b07e99828e3dbf85705caad39517171fc08d9c1670f845ccce955d32daefba5596d4007927ba3ea2a5d4fc18bec8498da875a66c08830996bf2f84f7aa6","ssdeep":"","tlshash":"f77000c00000c0c0c0ff00c00030030000f00300c03c0000f000c3f0030000cc033000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.377736Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"1fdff8c34626da4017aff0a2821d8b13","sha1":"55f2cd64499c15d5984aab9866dd55d365ccef23","sha256":"b3dff5aa27eafabdaad74a18cff6b5fe4c1d8f3772ecf27d7f97a929cb88de33","sha512":"12a4a8ae51557b64e6f163e5e00280848a72f3dd76e14dd56412fc97333a28201396a2c0ceff6fecb96345f552e2108a863df9ac2736d70e65a1366747206954","ssdeep":"","tlshash":"6c7000000000800000eb08c00028088000b20302c8800088c08003f0028000cc8030a0","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.40631Z","times_seen":1139,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"892073ca8ede08c4c19af3b85f4738de","sha1":"eabe1476df968605084d2546e97ee712e62657b8","sha256":"ebb8dddc409d0524ba533290ecbe2f1c59ada52063109d097a5617ddd53d514a","sha512":"e9f5b86eb6dc832694430db0cbb55360951151a9707f86d7eaa92d7e965efdff635955461fb743063d776952c66e55ba4e3f3e8d8af6a35f3fdb141dad5cddf6","ssdeep":"","tlshash":"b670000000c3c03000cf00c00030f30000f00300c0000303c000c3f0030000cc0c33cc","size":18,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.382948Z","times_seen":1165,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"3881d0ce03d76f22df4ba5ad7b17e61b","sha1":"344a651785ec5e4e5ca05d468aece729e927533a","sha256":"b14632ce7eeab46e72d4414f3ea594402c906d09dfba025f62ef714681b8008d","sha512":"4df66b1782d046d9e34662bbbce7034c57230c0b57c66a00ed9d8f4842a77f7bc01be54ace550aafea13735ef1107ac7d7ec6d7bf0aa3ad9eadfa420d241f47b","ssdeep":"","tlshash":"ee70000033c0cc0000cf00c3cc30030000f00300c000000cc30003f0030000cc0f300c","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.424529Z","times_seen":1113,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"cdcc8499dec336fe655502037873ad09","sha1":"df29230c72cec47be7797309e7f4dd868b430a32","sha256":"4b74080433c7e1e2cc034124f3f5acb444b95bd320d9ef3827db207b92214e6d","sha512":"0abfeb642770f7b88623dc119940432e2e68229ad8f25b2d527d756e94d0d66b8f6c0be04a98d9e8234927e737e977d26adbaf36337e1d3eade3ee21e0cf84f3","ssdeep":"","tlshash":"c4700000000fc00000cf03c0cc30000033fc33c0c3000c00c00003f0030000cc033000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.380887Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"160edc8db45d8cf1db6b306e01b1b522","sha1":"eb3cc2404ff47a884d1b38f4e5570e992c2b28c1","sha256":"5c4db52d774d189e67be581f8cf0a1be27580d903ac882f6dc8fcdbca5d4dc89","sha512":"4966aec1d737a12b8e232a53a8076ffa14c7ac1952e029b3081cda99be00538b3ad23f6f692e7fdc7182c83e19f63150249277fc2698d00b99de29865ce9a052","ssdeep":"","tlshash":"d87000030000c0c000ff0cc000300cf000f03303c0c0c00cc00003f0030000cc003030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.414136Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f5cab08d58af1c86a04a9231f211264f","sha1":"f2d69d788b83bd5ae40c26941d0c498b2fffd6aa","sha256":"f17b1d59157c1da10c25ba260aee32275310e2af951352611a5d40acee244cd0","sha512":"96a611175cf28ef88b66dc11d964de97377dc8f8b0672a69e311b96fda1431cc9f9de700ba3f3f210ce8815cdefcef15288a2e534708771f6796e25117714132","ssdeep":"","tlshash":"f07000000030c000c0cf00c00030030c00f00300cc000000f030c3f0030000cc003030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.379856Z","times_seen":1143,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"7d5854ef579b22b85a1308a464991cbe","sha1":"bca2593c39b377d192b5be3d23f73a6acc1ba9dd","sha256":"ee855aef125f82c560259778b792cdeb143dee61b40be24ae78345ba96ab07dd","sha512":"aa5d5459522b9787974eb941675153be6a008962ff4e0bbda6c7e6844b1ce2de8058cd99607b903c9bfd509b9df5cc8e6c9c84057a673d6ed2e764fef402cfb7","ssdeep":"","tlshash":"4b7000000000800080eb08c000200a8000b00b22c2000008e00083f0020000cc00b020","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.421378Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"54fa6a1a732804cb2eb71846c1c88c85","sha1":"ac48a7381ce0cea53de9797bff9ee3d827e1c50b","sha256":"28776dcbc8585ccfedc6125ab43dabb41c1733e77220bddc30365376adf9de4f","sha512":"da8a3b293933d9dc8dc0ab18576eaf6b25990ced15a13b9b5060bf8d20e27fd1a99e8046a6c42b648132688fa3dfaaa4bf821e5e4aa46f6921bd5db15f7859c6","ssdeep":"","tlshash":"227000000000c00000cf00c0003c000300f30300c0c003fcc00003f0030000ccc030c3","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.391321Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"c57e69dc1c3714796fe1663d7f6a758e","sha1":"103d84e469f09107059d8a67f615cf2e20652664","sha256":"eebd48c89f0b43036acec1a4db2909eeb314c5076bacaa6ac8bf9f4921a50ece","sha512":"18088b30af3e40d8f9bda2a487312b8ea56de42981041184b341fdb115613f4a25693cf00b574d68706ce77e393435be6ea49d35d51bbdb39134166e181c0fd8","ssdeep":"","tlshash":"877000000000c00000ff0cc00030fcc000f00303c000030fc00003f0033000cc303030","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.407906Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"35411849173c3d4db532cb75586fbeda","sha1":"068c3c37cd989d0b2ac9ba507218914b98f9194f","sha256":"419a2e337ee37ad5e724a3f328d81af33322d8ccacc12c9e4ce5e4e39fa2e757","sha512":"42c0cda45a2d89162022e03a24e13c26d5b8d295c1c35695ee166112aba2afd392faf318425b42a7e7f358b3d2fbe063199a39219379e9b00575d47b77e7ffc1","ssdeep":"","tlshash":"0b7000300303c00000cf00c00c30000300f00300c000033fc000c3f003000ccc0330c0","size":18,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.416374Z","times_seen":1161,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"b85819574e5970e1d42dbe01ece588e3","sha1":"41f6388934d879255cce5ac579ad8081280437d8","sha256":"68a074bfbfb0580f9e91dc885af163fc951ece471b3e477e02d8aa4dcd869bf9","sha512":"28eab177ad1d18905a342cf1bd06b0f966b77f439d5c08aff247df832d6dea20465459f2a6996d4934c63ec4d29a819b7e0433d814e72c47ba1985e8c6927b81","ssdeep":"","tlshash":"2370000c0030c00000cf00c00030000c00f00300cc000000c030f3f0030000cc003030","size":19,"data":"","first_seen":"2023-03-07T13:51:20Z","last_seen":"2026-06-06T02:23:39.378803Z","times_seen":1163,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"0d5998c0f8104238cd96cf17a9a2faeb","sha1":"8550a2347fba8b97c74e0b766f099c7610736be7","sha256":"89543153b3f84846def623cedf6219a84f697be7e8ba4f30d5b9b613c3f2ea4c","sha512":"31dfa548901d960e92f343439f06aac91e48c94a5028e32622d09e87a31c52adf666306df70e50bf189d133dac10b5b4cd2687a7694cef1be94307ae0828e259","ssdeep":"","tlshash":"8f7000c0f000c00000cf00c00030000003f00300c00c3000c00303f0030c30cc00330c","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.420273Z","times_seen":1081,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"d8e70e433e262e3409d713393b5055de","sha1":"279d1b9c1b4f513b80d1b5abe34e691269a5642c","sha256":"a4627a0619402e40b332d3152fcb46564ee28df15bb24963393da28364090d20","sha512":"dfb0974cad223dd5a6202f9ec965c017270249f08f8b43765481167142e3c67b93730dcf06c76215a3235ad55ba89d4f545a922f1c3e76f83959593e71bafb69","ssdeep":"","tlshash":"86700000f000cc3003cf00c00030300000f003c0c00c0000c00303f0030000cc003300","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.415257Z","times_seen":1079,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"569cbaa5d4e07d93d0ef40f00325dd8a","sha1":"d53d3ccf37eb01c61ab82418727c25fb284eb205","sha256":"c2a331c02c1ee796f08d7178d991fbaf91961275a5cf9986035d61a484fad97e","sha512":"ad99dee313910c9ef045e36e2b4f87c7689c54813bf764627d3beff49c6c1d71b80b5933ad9138436bcae2912e2d2c43702108ebe301a76a9974f5d4cce18837","ssdeep":"","tlshash":"d57000000000cc3000cf0cc00030000003fc03c0c3000000c00303f0c30000cc0c3000","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.38877Z","times_seen":1141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"md5":"f81a8aa27ad547b620591c871a087e2d","sha1":"77daa19609f08762d1e7544cc63e0feb2200ddc7","sha256":"6f75db5c15ff88f889f6ad98cf6ce1a0aef119df1777de1b1a992fa0798fa077","sha512":"32bf1a11a083f7acc19afea88e7249b24d88eae448c50c99f47a613db18679aa08b358de48421c80972e0dec7d8b64414ecbd74357a60d7cedc0d57ddfb9855a","ssdeep":"","tlshash":"217000c00000c00c00cf00c0003c000000f30300c0c030c0c00303f0030030ccc030cf","size":19,"data":"","first_seen":"2023-04-22T10:34:06Z","last_seen":"2026-06-06T02:23:39.418057Z","times_seen":1142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/cf-fonts/s/roboto/5.0.11/latin/400/normal.woff2","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.895Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /cf-fonts/s/roboto/5.0.11/latin/400/normal.woff2 HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 20612\r\ncf-cache-status: HIT\r\ncache-control: public, max-age=31536000, immutable\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KnQLsPRcCTH1%2FMWnE77%2Bs31DQPX8i8KA2B9MgyoZl2I7Shf6BprBsQwQhJCbiEWjGDEEo1DTU6QwgSDbUIUuphy6qdiLRIaiXy9i5BrpcB9hmHgx1Cc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\ncf-ray: 9c0e849718488deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20612,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 20612, version 1.0","md5":"b07da7aa3e4f363c5cdbc11312239e8c","sha1":"47bf5b2f24ea4a4caafccc89b9d2a6677ef9e3b8","sha256":"e44c11f4834bdd4d6b6da7b8ee5eaebc8acb41250cd6bce5cc82ea8262140eaa","sha512":"420729406b315d8af34b62b78f39e763f5cf33cbf94467457b393fde0573dd7ffc6a23f25680988f9b82a4a3b719876ff76f3e1db047ce82615f544fc3a82532","ssdeep":"384:k5Eu+yl5Y9RpwjjmD/8Qu+POP9w+oB7rezldH9W4EMs8qCr9WvS80M8T4PTEXPFw:YEu+/Jw3FF+WP9DC/ez79jcCrb8BK4Eq","tlshash":"8192df6bce71497ac711262c773917addb8b44f627f91f2ba0562411c7b8e015c2cc7a","first_seen":"2025-01-09T06:25:34.419113Z","last_seen":"2026-07-26T23:02:50.245411Z","times_seen":47668,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/4306.fef4861e.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.869Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/4306.fef4861e.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 5891\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:11 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fKiObm1gU48oqi4imHJJuq8Z%2BPrOf43fa955J9R1fUSCx6mZG0RWMwLmaInmGQYf5n14GLt4jINWSHLc%2FLqoWvSkKSel4e2dD5H8cO2efRWxH8TIW%2FQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a19d68deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":25110,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"d29dcff57e0b52ec13a034b6ce8b784c","sha1":"df6d65bffd2947126f196667356207d05eb97cc5","sha256":"216fb75b9859e6a252ffcba4bde1b6b48c14d84ec7b2261a187586db1f82d3e4","sha512":"e51ee566eae0ce2b6b86e9d05fad421c35426c4e11210ff185163f761f247a20907b09e9d562aa9679db6ce93bb922885aa5bb5ce1c9c1afc0e4f913e93f7dcf","ssdeep":"192:yTGxO3goEpIs8PxS0aGpKiRcxr6YxgbbMrVh0bIMh+bYYhYbYTLDbx5bxBBYxtVV:UJrQkGFgfwEHCpSqTq+hFUUE","tlshash":"61b2d8b6c43224053ffab6a897d74109da442297e642d9ae7acd7348cff05ae7040bcd","first_seen":"2026-01-03T19:33:29.794048Z","last_seen":"2026-07-23T22:44:16.903783Z","times_seen":10,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pro.edgeonetech.workers.dev/?v=https://cdn.midasbuy.com/images/EN.e6fa2f58.png","fqdn":"pro.edgeonetech.workers.dev","domain":"edgeonetech.workers.dev","tld":"workers.dev"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.136Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgeonetech.workers.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 03:54:13 GMT","end":"Mon, 09 Mar 2026 04:52:54 GMT"},"fingerprint":{"sha1":"F4:B2:62:FB:D2:D4:1E:2A:1E:50:BD:8D:39:B6:F9:40:95:DB:46:12","sha256":"9F:03:DA:8F:5F:BB:ED:ED:4E:60:40:13:20:94:04:33:9F:BB:5F:E6:43:E3:5C:1A:69:94:B7:FB:BD:7F:99:14"}}},"request":{"raw":"GET /?v=https://cdn.midasbuy.com/images/EN.e6fa2f58.png HTTP/1.1\r\nHost: pro.edgeonetech.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6S2n1X%2BXhw7%2Br2flPfmpMFhRMxrLSK3Eoy5ArfDS%2FW%2FqplIl9EIZ0UJTPC8j02VJ1TuLbj58KWAiSO4%2FtQZa8NkaE7qDVmhHNjbYmmThRgWaOZrsfkmK95U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c0e848bc84b5694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/671f8d2ec867810a0d085c3e5c94e9fb.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.327Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/671f8d2ec867810a0d085c3e5c94e9fb.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:22 GMT\r\netag: \"3c414d53f0c5db2bc26ceccfbac3784f\"\r\ncontent-type: image/png\r\ndate: Mon, 04 Nov 2024 12:09:13 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 13064905244496772742\r\nx-cos-request-id: NjcyOGI5NjlfZTgwZTc5MWVfODY3Y18xYmM2ZGFj\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc0Mjk4NTk\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2945\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 13708912378146516169\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2945,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"3c414d53f0c5db2bc26ceccfbac3784f","sha1":"64c9a6b329df7ab67e647542be34e3269e7008e7","sha256":"22b5c27d040dfde79ef65bcfbe6a6bf7d5a5c413eaf4e1f3915fcecebd852eb2","sha512":"08ed045365f1652091a6d0ac820fb0b2214340090b470e7d1827974b3d82c7ec65c53955b716520e676312160c3550177e4b662645cbdc0f68fc6a8498dd1aa7","ssdeep":"","tlshash":"a8515c31dd15390a21efbf722107362445d19d1b86bbd1098567c036e87c7948a7d62f","first_seen":"2024-10-30T20:47:39.029813Z","last_seen":"2026-07-19T01:02:47.4835Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1496,"timings":{"blocked":705,"dns":0,"connect":0,"send":0,"wait":787,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/d67a787d6a09a7e13f7113353d5860d7.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/d67a787d6a09a7e13f7113353d5860d7.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 08:38:18 GMT\r\netag: \"19f4213c698a8bd2ac11513a69a16804\"\r\ncontent-type: image/png\r\ndate: Tue, 20 Aug 2024 09:12:47 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 3612255795022076232\r\nx-cos-request-id: NjZjNDVlMGZfZmUxNTc5MWVfMTMyZjZfMzYyNzdmZQ==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NTk0MTE0NzAwNTA\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2645\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 3965043830302411803\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2645,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 96x64, components 3","md5":"19f4213c698a8bd2ac11513a69a16804","sha1":"8569355e1febc504d9b8afb0099bc1ff3a108a17","sha256":"cbc004f54d5c4b39d6d69a08829c942f21d9f2efd5dd3806b1da79b6eed58b35","sha512":"fa923e966ea20edd4d99e01244f62b4bc149ac5f79815fc8407f8ae1a4cd82722be64c6f2d1539c7c84ed2703eeb8c2c186f528705a71fc76cb7915d143804b6","ssdeep":"","tlshash":"0551e958b5227b03f958de72a2f2447e1f2d48c0b6daf94df5f7c842a1980f4a1285ce","first_seen":"2025-01-22T15:28:39.188346Z","last_seen":"2026-07-19T01:02:47.509364Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1494,"timings":{"blocked":701,"dns":0,"connect":0,"send":0,"wait":793,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/style-img/googlebtn.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.527Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/style-img/googlebtn.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 2775\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3vF4JtpjwtHREYtgmSuwdoY9IMXIWq75kFyFmyonzRVnjmhh%2FfYk2ZAzUC7tbscrAUR8Ko8vP02AL6IKm6Akn8gtMwzlyaF%2BH%2BEPNfgEQc4j1074Hvw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c1fbe8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":2775,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"bb07f711725f5105be35ff613045dece","sha1":"cd5003c8d6c86715cfe19485cf8ac8c3eb72d2a9","sha256":"192b586678e57d05d94f8b363c7d3bf4fbb3241e7690ef880f0cd96ff6bd34f8","sha512":"2ae6225fe93d8229d704a6d12a1e028c6a4274993ada82ed723181bdbcfe86d05b90d6d207d87442c95a2de21185fa11d50a0364c0415793262c83af7dd8a93e","ssdeep":"","tlshash":"c7512ce7e7449864c8d73a25f5e26c9e7caf4e912742e00436c2dd36cb6a10a58443d7","first_seen":"2024-08-19T17:03:14.927888Z","last_seen":"2026-07-23T22:44:16.930802Z","times_seen":50,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/7309.5f36e764.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.789Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/7309.5f36e764.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css\r\ncontent-length: 6455\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:07 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w1colOSXH6jpBHReHcNlOiEATqPN3SJsujbL7AXnJQwxO6eiiC7UajuQrG2cBN650MK52xfdZshTZevpmYD%2BOeqmAB%2FphSECpfULjfld7Q3Fl8xEklc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e8489d9298deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":36411,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"3caad3e71cb26bebbea8e9b9a9aa1d1a","sha1":"c240c32c9abd13fad56d158f52bb1dad0980e185","sha256":"884710b4005640aabc8f46580601e44126f88bf440ddb7671344e4b8560087d8","sha512":"55fd9db494e392691e5fcb4260258a868c7298911830df967c6aaf1fef99f14372884136cf863fbbf9abd52d3f83853796eb6b60638b37e0ebd94cf24d64d800","ssdeep":"768:mAt7xXWo8ii9qnZuQnhazbb2Gry2w934q6w:liQnZuQnhazbb2Gry2wL","tlshash":"58f2fdd2a91ef9a061327a60d75f8595ef86a4f309723c6cfdce50c82ff15789104a8b","first_seen":"2026-01-03T19:33:29.80357Z","last_seen":"2026-07-23T22:44:16.933537Z","times_seen":10,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/2690.2a22e3f4.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.865Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/2690.2a22e3f4.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css\r\ncontent-length: 51206\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:11 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qzEe0MfCfWo3aR3EXoXCYMTaCocUst6hrC9J0VzARqCng3KtzLvEzplAK%2Fo0hiPO486v6ZxMYKYIvMR7Ml4iKwivqn5V8PVy8RcBSm2QR%2FzQt03Y1xU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a09c88deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":328825,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"8504d6b9de1d2c89afde6ff4bd2e89db","sha1":"529d58c2befb761a00b71d2cf6236287b21b45f0","sha256":"873e27b66b23d9ec54d972cbad8ccdd5562c187a754f5818b7e6012bd5d8f541","sha512":"59fc4c13a5ebcb572ba255c86143ff74448ad3dd1afba50a1f3bbdd7fef7e1f31c739313f7e464ee6ed0aaa953b21af4609c5f72747a23f7fbb5cd252acc128a","ssdeep":"3072:RVoO7BumVwfSeGz4VU4rS5ooxfSH047+3BtgVnVjHxNAV1V/cJV9V5jVr:voUBYaBsVjHxUjUL5xr","tlshash":"5164d43e8a135e4eb2739fa0eb93062aef56001353c90924bacc7b568ff24bd5511f59","first_seen":"2026-01-03T19:33:29.739343Z","last_seen":"2026-02-18T03:17:18.031139Z","times_seen":8,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/BLtmnm0.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /BLtmnm0.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Sat, 18 Oct 2025 15:43:34 GMT\r\netag: \"d467f22e14ef2e023566a2557527698b\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: kWlNyzJYUObvBHaEjn9y6gQGoUUhZi6gnK8qfxTcVN8zQSFMjlqQng==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 2440953\r\nx-served-by: cache-iad-kcgs7200105-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 291, 5\r\nx-timer: S1768911541.115843,VS0,VE0\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 2581\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2581,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"d467f22e14ef2e023566a2557527698b","sha1":"1d31aa63a73643c196e06ee5aab1a0e9dbf20712","sha256":"1185614251f66c33e4ca6f96a05e0c29fc1ef204c0f574883ad1c3ed1bc1821b","sha512":"40559b6b8f8b2171d6e8ca0be3a48511c1c98085ae5c9dacc1fde4e9689e0f20f4d56f78cc8b77492fd9c3899a398e379630a2dd48a2833157edae2b410e9814","ssdeep":"","tlshash":"c6514c0a116e9468c39e6cb3bc29403751bfa6858725b15c17bb0af69473b50d76ec42","first_seen":"2025-12-13T04:44:10.867629Z","last_seen":"2026-06-09T03:21:51.999084Z","times_seen":17,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/bcb080d61e19bf094ecc4297d1baddc1.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.210Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/bcb080d61e19bf094ecc4297d1baddc1.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Tue, 10 Sep 2024 02:24:20 GMT\r\netag: \"cf1477578e85ea473c4bfd4068adeac7\"\r\ncontent-type: image/png\r\ndate: Tue, 10 Sep 2024 03:12:45 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 12296676752358814526\r\nx-cos-request-id: NjZkZmI5MmRfOGFiMjQ4MGJfMTExZjlfNWNmMzY3Zg==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwMTgxMzg2NDg2MzQwNjg\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2683\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 14931603519482895635\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2683,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 120 x 80, 8-bit colormap, non-interlaced","md5":"cf1477578e85ea473c4bfd4068adeac7","sha1":"43120994f89f4dfdce6dfa5621375f79b0e28698","sha256":"5f54f14d61306892a6c066e7c8fd68ae8f55d5c9a142e550bc4cc5cfe2a5a6c6","sha512":"2376c9d465f2349205e71ee169e826efd5e9a0caf7d1db8fb4b8a0b5ce6111c5776ded2d3997f48750cc4394d0f26c3d8bf039aa940b1433a2bff8cf769534f4","ssdeep":"","tlshash":"c2515ecd84e1a700751115499d2d2a64443e7e0733543b0e5265fd3ca5334db2ac0ddf","first_seen":"2025-01-22T15:28:39.189869Z","last_seen":"2026-07-19T01:02:47.574257Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1615,"timings":{"blocked":822,"dns":0,"connect":0,"send":0,"wait":792,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/641903dfb1304392d5b0865d594833f8.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.322Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/641903dfb1304392d5b0865d594833f8.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"34cf3aa55d10f3f8869f264cdcb2ad5e\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 21:06:23 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 2435251802681037888\r\nx-cos-request-id: NjZmNDdiNGZfY2FkNDgwYl9kNTVkXzdjMTIzOGU=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc2NzI2NzI\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3523\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 13616906317450589317\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3523,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"34cf3aa55d10f3f8869f264cdcb2ad5e","sha1":"94cd8a7d54c36f1ce3f1a5d8925ef4e5c33da7f8","sha256":"6da833d493a4e1a3bf46b9d484477687d4a3c2c92aebf24c82f9e5f128b4368d","sha512":"204744a724e1e64e3c8af81ca50b1efd69a8b0d50f64c6722d71ee8d956a7781b15b9233071e32be8b24267925d5d7e29613e7431480a4e32bc21a7b4c43810e","ssdeep":"","tlshash":"fd715cb2acdb97b2616777a957351c46d7640b0ec9227a191104ee3d483432d28caa0f","first_seen":"2024-10-30T20:47:39.071579Z","last_seen":"2026-07-19T01:02:47.437484Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1502,"timings":{"blocked":709,"dns":0,"connect":0,"send":0,"wait":790,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/0ebb4d6c45004043613005a8f40c7f8e.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.409Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/0ebb4d6c45004043613005a8f40c7f8e.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 08:38:18 GMT\r\netag: \"dc48db1d671abdcfd220a9e678948427\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:15:23 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 19768526227727648\r\nx-cos-request-id: NjZmNDFhZmJfOTZlZjc4MGJfNGNhXzdiYjJhOWY=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NTk0MTE0MTI3MzQ\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3512\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 1845780916028576290\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3512,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 96x64, components 3","md5":"dc48db1d671abdcfd220a9e678948427","sha1":"4d17b383a4368a01a6fa6a6c328f3b524701335b","sha256":"05b94aa34e47b28b86fa8d3c16149ca254b26c0c26b843e7cb1d4ba5a49deed5","sha512":"2f6d4a6e15a5b1423355b7f05799c3463d580d6db0cddc724c3245f5a06ea88a1cfa1afd9d38707e60278bc59627855e546ebb3c94ff47d46f2f9b434cdf0921","ssdeep":"","tlshash":"d1712a17f5953b41fb589d323af38a128f051482b2e3d86474bacc0a55371b009263d7","first_seen":"2024-10-30T20:47:38.995699Z","last_seen":"2026-07-19T01:02:47.560505Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1678,"timings":{"blocked":624,"dns":0,"connect":0,"send":0,"wait":1053,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/F0b1bi7.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.176Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /F0b1bi7.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Sun, 19 Oct 2025 12:16:28 GMT\r\netag: \"31238005dc867be574efba20d87682ec\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: 1RM1TGROCAjISWrX78-T15ebSj-wpWFkZQ0zBhYMDU13YMaXy4OtMg==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 1815349\r\nx-served-by: cache-iad-kcgs7200082-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 59, 5\r\nx-timer: S1768911541.115278,VS0,VE0\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 5109\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5109,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"31238005dc867be574efba20d87682ec","sha1":"2fb46d16365d81ca00246f79116952a6f27e1ae5","sha256":"0256ad35213ee17bf8f061a615ae516054def359b096437be1dbb14ead8de9f0","sha512":"5b328d545c65230efac7a188f011d4e0d67046d5e2aaf4a27735d0e5812e0a1ed55ad2fd9c79fbf6e08678c2244656f21c06e2d2bac3eedf5ec3eec47108d535","ssdeep":"96:tjc5LnkKBFZRPHOshw+3jv1o9ES9wq9LJXosP4Ab61cR2r+6WGcz:1c51ZRJaNR9wq9LGPAbOcM+6Mz","tlshash":"a3b18d96ee287f18866f04d0723c2bf40621d4877c48ba7a1d86f42f3c66293a554a38","first_seen":"2025-12-13T04:44:10.839525Z","last_seen":"2026-06-09T03:21:51.992556Z","times_seen":17,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/kotak.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/kotak.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 12543\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:53 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Dof5m9ptUUYt0RnurJKj%2F4LT5hOAQJCOllWP25hPOTjW13A27rxo1g5AhYIXker28D9kqHP0WxueVNrrov01UluSg4BxzGdZk4p1OWSnC21PW9H4VFs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c2fef8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":12543,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 396 x 396, 4-bit colormap, non-interlaced","md5":"96998f93318eeb1ebadbcb472410be96","sha1":"1539b22930c46c466425015b14fdac2b3b2782a2","sha256":"693719b4fc80e357b8adf14a5aa17f3cc4ae6e757ec8c2ad05cf5060eada7a07","sha512":"4d3ad974095d6a2c7e3344d34e621ce855cb1519f9326ab95e5f941d13a38f30686a4dab4729bc2472bfe045559dd0ee0aaf7a37b132dbdb1771d12b2f5cfea3","ssdeep":"384:uFls5m1PVT5RxUaC9w2ggVyX7D1atXIGMK:0s6BxUaqlnVG7D5GMK","tlshash":"6d42cf56208695bde506a3ac595598cf24c1f59db5bab0d7efcb3dc42ace318308b331","first_seen":"2024-04-29T19:19:01Z","last_seen":"2026-07-23T22:44:16.944248Z","times_seen":33,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://midasx.specialfor.za.com/","date":"2026-01-20T12:18:59.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/ HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midasx.specialfor.za.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5wcUcWzONDXBRB9N10DCdSDLKzmcSfePt6cbtXnjRQvjiaYcxrg%2BRnyM7Wmj3hWaRs4zH2uGaElMbY7xwAzQKM3V6%2BY%2BNZIRaZJTvS1yWiWVA8NP\"}]}\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\ncontent-encoding: br\r\ncf-ray: 9c0e8483fd810b45-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"jQuery:1.9.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"jQuery CDN","description":"jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder.","website":"https://code.jquery.com/","common_platform_enumeration":"","icon":"jQuery.svg","categories":["CDN"]}],"data":{"size":119205,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (4870)","md5":"8301135f1a66aba172b78e3bdb339abc","sha1":"409c9eb15eac5cdd14235b0a7609de6436e3074b","sha256":"1e4be851db9fecd499deaa3e4fc95655f1af251c275f6afb62919c235bf12758","sha512":"79b1e7ff1e34100aea87b513b10fda1976be85c17c18028dffc41dfa8d8097e6bc7e401556b9a84a3532dda3295422631ae3ba248e00c8562d270433385176e1","ssdeep":"3072:Bvp6ZxPoZxHTgPJVD4YmPmOkAY8LnQnPfM7rLlGdv27r8tDId02iwka:fTgPJVD4YmPmO08LnQn3M7rLlGdv27rd","tlshash":"6dc3a6724006643b670388d5f2b72b5fb0b14a27cb4bdd16a2f8579cefc6cd68e26644","first_seen":"2026-01-20T12:19:47.887762Z","last_seen":"2026-02-10T22:46:25.366986Z","times_seen":4,"resource_available":false,"data":null}},"time_used":966,"timings":{"blocked":56,"dns":36,"connect":2,"send":0,"wait":852,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/1446.0f03293e.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/1446.0f03293e.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css\r\ncontent-length: 6168\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:11 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KHwNIXE4d1F8LklDqQMJla%2BFnCjxzS9uKiPuXl2dOoS3hOJPOe68GmKJ4XzYuSucctZCHMbGuxihfpgtuAZV%2B0kmsJblgSFs1JtOk%2ByD0pGHZF4UVco%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e8489e9788deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":41515,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"e96f47804a8e49491b6288491e8df9a7","sha1":"c9f9cdcbdc9a0c1d26fb53a91ddfb22f2916f1ef","sha256":"0a5d8e4777bd859bdabe9a071dae2a9ab28d34aeae81a022fb965873112383f6","sha512":"760a745357eb5491c27c64b0dc0525510020394a12c4b678e3cfb26a7f7d5a9b78e18ee64bf53a57f40c7689a9f2a1a6ca7f1d22acfcfe7b60962fc2d2cbe69e","ssdeep":"384:FnDqt9TV3fmUVF9wEHCpSqTq+Fq62DM2gRuZwEHCpSqTq+/Sg8:Ki9qSuVi9qbD","tlshash":"2c1331a4c5231d059e37af90dbab7068de0078137653086c79dc5576eff21e8d22aeac","first_seen":"2026-01-03T19:33:29.738144Z","last_seen":"2026-07-23T22:44:16.917988Z","times_seen":10,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/1982.be4a334a.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.885Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/1982.be4a334a.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 10955\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:12 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gCvg%2BtA6eDKdzgpa949qYEf8Tk6G7YjIWMFxlcdcSXGSbJMW%2B8UygWHv9WtIT1AaEImFBh2qYipT9ddRtwSm%2Fy%2FqhOVZHCh2bId21UDIllmjpW0oAjg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a19fd8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":113069,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"1be342bebfce71b9bb26c8ee247b5b74","sha1":"e838fe15b6a786d6b20803138ce6aa2725ab4a04","sha256":"1144d59f726f3e3fbe688f5a8ff5237c32b2771e4be9c1dfbcb32a22e2b0bf95","sha512":"bdadc9cfa3842a206c21b691537fc93a6fb8d7635fbc018201a7938a06af3e57bfa46bf1c0b0bcf410f9a849567f6dc4670715c2d157bf9faebc08a1e0da626f","ssdeep":"768:jDi9qnyi9qrKIqJ5FsWCy38SosLUx3P+/mR5oCJTUow0Mha+Gi9qxf8xA8waCi9r:jDiQyiQVdiQdiQRc","tlshash":"d7b36251c800a6866532afe1db73126ccb84f13761969dad3fce258f9ff016c9217e98","first_seen":"2026-01-03T19:33:29.770597Z","last_seen":"2026-02-18T03:17:17.902112Z","times_seen":8,"resource_available":false,"data":null}},"time_used":222,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/css/flaglink.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/css/flaglink.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 1654\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:08 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kuNJV87QJYBHXqlLeD68nN7b9P3n6ZIGCWTs%2FgbvYJrqBssGAbJ90mcnHOATKhGAhv%2BTdhNXRLSuIVy3n3MldtcDyf1AFgBREcTlg%2BUtKGaeo9grPlU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848aab848deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":14690,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (14690), with no line terminators","md5":"958e119c09a94281c86f41edbc55e353","sha1":"e9f9710dbc493154a5ba6f674cce2b0c951f5df6","sha256":"27b19ce922bc8af7755cbd1cc6bdd1e60d7acfaf31c27bfd1d15e9dfa5e92eff","sha512":"488179055782b84126852de985208ca8d9015a81452d9c3c35087a6c73ab9d8952119de92f0941e4c1b2b7e6877b65a934560bf20dc829c3c00a402e03881092","ssdeep":"96:IqolNwKMs4aqDKsLyXvqcGc1QV5BXNGAXp1ewSkYFNgGP7WWNBU:8wKj6DKsLyXvfzm1XNGA5IwwDxpNm","tlshash":"4b6218558bf3342afa23d56261b00e85b33ea007d43a4f3c6d19bf6963417e519e3a72","first_seen":"2024-04-05T19:37:46Z","last_seen":"2026-07-19T01:02:47.498772Z","times_seen":102,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/css/notif.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.004Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/css/notif.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 885\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:11 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=GcTaUC7KelUOgKrLAKrOcot8Y8vjQEdSlFc8aanxnQan7MSV2O9CfoqEH1ZGpT7uzLEkD8PLkEQBaAV3LOOLx%2BqHb8CZBwPw6FoDsJ2CbNxU7n5aeiU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848aab8e8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":4376,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"e953ba2d94ee96cbecb7949614b448db","sha1":"0a1602baa8d259a832e7735c0ebb689acb07da7c","sha256":"33bffb6c474d5923290ee247c46b20301eea1e7d17243d775b5e4b35c4a3920b","sha512":"a60d398d7aa9f3623c607f8c4aa76b5c8706c31a81e0595a771d0cd4c3e727286308a1bc4d1fce761f90e2885c819a30d44c27c8f5a92b5a2a4d2494013fb957","ssdeep":"96:k5BBEUpnzndtXSs3f4IkJQnj/cRRP8R5VvL+:k5vEU9zn7Z7kJoERR25w","tlshash":"b191dd58da245048f272e5edbff01b92f8490863570f81ebb9a47454cf6662d3a62acc","first_seen":"2024-08-19T22:58:59.094095Z","last_seen":"2026-07-23T22:44:16.912997Z","times_seen":22,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/SGK9e5p.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /SGK9e5p.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Sun, 19 Oct 2025 12:14:27 GMT\r\netag: \"ede6e263027195a895264bc7dcf41c98\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: tUxIQ1DjdgZehd3MmB6-cN0nG__EMY-D6wbuEwzpyF6f8b0Pgx6K2g==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 1740030\r\nx-served-by: cache-iad-kjyo7100170-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 49, 5\r\nx-timer: S1768911541.114685,VS0,VE0\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 5851\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5851,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"ede6e263027195a895264bc7dcf41c98","sha1":"47deab3640a77d43d7c28cb4fca1f7fa44375f33","sha256":"1b7ec1216638196ff36c2b9e4d4d10eb468b1a17f109ef8aae2f25ebb5d739f4","sha512":"5de94ce6c3d38de4b421572222e8bc589c1c60c17a62d155c988f25db8e77f317b46645bd0e3e595b44f2bcd3846021061199b200ff8915e83abf5836ea6074c","ssdeep":"96:GskwDESepgt+Bj3Xx+OeFnBF20vqsrj9rr+5XAze7c5+Ad1Fo5Ufx8UYaOgh:GuB+BF76A0ysH9bwlUC5Ufx8UYaOgh","tlshash":"94c18f4dc567c0e0897ea242c4121bc4ef92a6a8d4310f6ae8bc75d8d65973ab0d641c","first_seen":"2025-12-13T04:44:10.866205Z","last_seen":"2026-06-09T03:21:52.014282Z","times_seen":17,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/25a8889049a89344ddb6a1d99fddacd3.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/25a8889049a89344ddb6a1d99fddacd3.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 08:38:17 GMT\r\netag: \"c215c8e11cb084d49e5b9de1d4a95c90\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:15:23 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 9041043765420463187\r\nx-cos-request-id: NjZmNDFhZmJfZDJlZjc4MGJfMmVhOTVfN2M3ODAxNA==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NTk0MTE1NzM3MjI\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2977\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 11589512917680046620\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2977,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 96x64, components 3","md5":"c215c8e11cb084d49e5b9de1d4a95c90","sha1":"fd583e8bfe1389b58f1bf6356518e26c686b09c0","sha256":"74bff356ceca1af7fc6b0603fa11cbf7a5ac5eea8d0acc6628a88e1865203d95","sha512":"8d257be119157948296ef67c0a1359f549bfcdf5128036007cf97bc186276af5607cb898af4ceff27e3eaf748a682a5df1b99c902128a9dd027859c700693757","ssdeep":"","tlshash":"8c510904e7336703da49b83574f9615bc6791684fa93e069e8fec9a609720f08d525cf","first_seen":"2024-10-30T20:47:39.008354Z","last_seen":"2026-07-19T01:02:47.541148Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1867,"timings":{"blocked":828,"dns":0,"connect":0,"send":0,"wait":1038,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-1.10.2.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.290Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-1.10.2.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-16bb3\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\nage: 1041204\r\nx-served-by: cache-lga13622-LGA, cache-hel1410021-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 1, 7622\r\nx-timer: S1768911542.295520,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 32788\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93107,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32072)","md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-27T00:09:49.201613Z","times_seen":16822,"resource_available":true,"data":null}},"time_used":17,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":14,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/main.4e01e1c8.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.782Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/main.4e01e1c8.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css\r\ncontent-length: 224929\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:07 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SnnDSHam2s88yfHl1XU4dadQ%2Bz6wF4EyZUb9U4vQdDgSc035fVinqCpw4luG1HUgJBJ14Ydhe1yGXVhJFbmxJgd1KVk3Wo%2FalFLdDP1vUNwvTqdyUrI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e8489d9248deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":491948,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (11239), with CRLF line terminators","md5":"7a3efbd44de5c940224aee089b7a96af","sha1":"fb16c012dd6e4836551bb9d389ed48ccd4c0d87d","sha256":"7b1d97d65377fd346bde302f8e43967bc2408432675a333c62645b3ceec3c6ea","sha512":"3fd230f69f93e4564036089f99af5a7c1fc506628ad971900cfdbf9eccb50ffe8d311382ba209f090f2f4d879eabbfdb2c7fe355b01823187a94d76204b71c1a","ssdeep":"6144:ElmM3L0esj9nC5N9fZ/rFZsUEmr7rnSN08uezJACuYY/UXT9BBk:EAE0MZ/bsUXzSNZdXhBBk","tlshash":"0da46bb1698926cdb6234f3ffb16683aad1a64ff7a4084ce7cdd36d487321609945cb0","first_seen":"2026-01-03T19:33:29.748162Z","last_seen":"2026-02-18T03:17:18.074395Z","times_seen":8,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":76,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/css/style.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/css/style.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 1412\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:11 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UMIgXdVA3LQCVV4QpdJTSeiZzaKVlTlqGNn3hF8Xy3EgARndOzs937ceRRhJ%2FqbypFa%2FXr1QdxGa2Ul8rV4gDYVo2ehn6Ln%2F%2BTN9KA6nx4l8MLK6%2B8E%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a8b448deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":8992,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"c6a0e3948741cb54aec7f36827342d6e","sha1":"6ffa27eab3ae3ed5ea598db29f6ae457667fc566","sha256":"cc9f50b9f0acf7e86d461d515b102be25d7cbb7f0b644b8b0648ef480c5591c2","sha512":"4dc20904ca9426fc6c1564008263606ef1793750ae5204607aa25fc73bfb9503dc524911eff9275b6d75b66561aec5eeb3ab12ff3a26720aac133f3ba4ed3a40","ssdeep":"96:RCUXcUrTFNY47UCUoVHLwjev/hYLrgDND+5VqgqbIwOQBWjNdUW7MtYUjYTsY4YX:dJYb2LIUJy5h3S+7","tlshash":"0a021421db16204df236d5f8fb7127a3ea012547978f86bab9e07054cfe196c26726cc","first_seen":"2026-01-20T12:19:47.905574Z","last_seen":"2026-05-09T11:43:13.718658Z","times_seen":8,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/close.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.510Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/close.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 1170\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3W8KZm%2BdphLniHLnDEalQj3hdVCKJOkgGXHT7lenIyCdwzUkvPsUJtrUosjRjl4QQ0J86YLwDv8s3xfCwKt4po6465Hq3RLKoJ6QOzQRhXFwiPqYGAg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c1fa68deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":1170,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 43 x 45, 8-bit/color RGBA, non-interlaced","md5":"68fb5b6f86421b10e17cb96a65cbe4d3","sha1":"80dd39fc67e874953d49ceb2321a1147d0018821","sha256":"d0eda953f3d7bb15aa078cb44b27702566108120d8b9b37e9a3324e2b767aa08","sha512":"ce1acad1d513c03a18e935cc6a9901bd828e63417ef454b11f002a8da58b833c993f170e9cb483e2b04d2b29e25146c509176183966584d21dfaa3dffa975998","ssdeep":"","tlshash":"2821c6c40c38049ed54bad25132e40a8ab19f075c25a12fa6c3ea63a734f73525b2f6b","first_seen":"2023-07-14T06:38:20Z","last_seen":"2026-07-25T23:58:14.662138Z","times_seen":283,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/2f41bd3cf12ec520f03bda90a4d68c59.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.319Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/2f41bd3cf12ec520f03bda90a4d68c59.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"749b5bb9326f07330244e0839b8cfd94\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:15:23 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 4357609762427031897\r\nx-cos-request-id: NjZmNDFhZmJfZjgxNTc5MWVfMjE5MzVfN2NlN2RkYw==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc3MjU0NTM\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3286\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 7506451326927852984\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3286,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"749b5bb9326f07330244e0839b8cfd94","sha1":"93d3987eb336bb26c524bdc636f4a23118afee0b","sha256":"720674c55c4e72f335bd33974da2ffc871c6405fb31be3128cabe939baf1ed71","sha512":"2f464b1df087df803218b46259a532f4994ad27ee38557831783fac173e39302452d9acf68052c37b24dea7d7d9f75e1368a050242f80eb29e5fb15b9a959bad","ssdeep":"","tlshash":"4b615b951a773c365290eea81336108a7bad60b16a1c405e1837363ecc98ac5bdee339","first_seen":"2024-10-30T20:47:38.982315Z","last_seen":"2026-07-19T01:02:47.547807Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1485,"timings":{"blocked":712,"dns":0,"connect":0,"send":0,"wait":772,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:06 GMT","end":"Tue, 03 Mar 2026 17:10:05 GMT"},"fingerprint":{"sha1":"87:0F:C1:25:08:22:50:0D:D6:14:D4:EF:A9:CF:49:70:C2:8E:5D:36","sha256":"65:A3:E5:AA:4F:13:A5:53:EC:B5:39:DF:03:7F:DE:7D:6F:2B:23:33:85:34:59:13:C3:FC:C2:AC:22:E9:97:D9"}}},"request":{"raw":"GET /s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://udgqcvkk.fortoday.asia\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 40128\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:20:02 GMT\r\nexpires: Sun, 17 Jan 2027 18:20:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 237540\r\nlast-modified: Tue, 18 Nov 2025 19:00:07 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":40128,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 40128, version 1.0","md5":"9a01b69183a9604ab3a439e388b30501","sha1":"8ed1d59003d0dbe6360481017b44665153665fbe","sha256":"20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2","sha512":"0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca","ssdeep":"768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO","tlshash":"3703023a5e3ccf1a84157a703950f6d9a8481e548e9d143b4f1ac7bf085dde2209b6d4","first_seen":"2025-01-08T22:59:02.845106Z","last_seen":"2026-07-26T23:46:15.858348Z","times_seen":946578,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":66,"dns":1,"connect":8,"send":0,"wait":8,"receive":10,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.midasbuy.com/oversea_web/static/media/DINMITTELSCHRIFTSTD.a7bfa1ad62bf8ba2fa46.ttf","fqdn":"cdn.midasbuy.com","domain":"midasbuy.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:03.121Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.midasbuy.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Thu, 17 Apr 2025 00:00:00 GMT","end":"Mon, 18 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"36:C0:42:2D:03:4F:38:58:E6:A1:2A:40:FF:E0:C8:99:CA:D5:21:99","sha256":"30:85:DB:98:42:24:54:F2:64:05:32:EB:ED:AD:83:0D:25:C2:2C:34:27:EF:72:1D:D1:BB:C6:C7:B0:BE:EC:36"}}},"request":{"raw":"GET /oversea_web/static/media/DINMITTELSCHRIFTSTD.a7bfa1ad62bf8ba2fa46.ttf HTTP/1.1\r\nHost: cdn.midasbuy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://udgqcvkk.fortoday.asia\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ncontent-length: 0\r\nx-nws-log-uuid: 14806082874859735463\r\nserver: Lego Server\r\ndate: Tue, 20 Jan 2026 12:19:03 GMT\r\nx-cache-lookup: Return Directly\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"font/ttf","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/3f257e30007c6b106700806f33f68c1f.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.230Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/3f257e30007c6b106700806f33f68c1f.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Sat, 07 Oct 2023 08:33:50 GMT\r\netag: \"e1c044a9f27e5341af0240977fa9bb1f\"\r\ncontent-type: image/png\r\ndate: Tue, 20 Aug 2024 09:12:47 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 14662779507684792094\r\nx-cos-request-id: NjZjNDVlMGZfMzZhZTRkMGJfMjBjNjNfMzZhOTBjOA==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNDc0MDYwNzkwMTIyODU\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 4746\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 13626781759319562896\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":4746,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"e1c044a9f27e5341af0240977fa9bb1f","sha1":"a236b581e6f8818f516ab468eee86a7ae843c270","sha256":"77ade61328510c55deabbdc179c3b1594b3502d8ce00206605de1d8ef0a8dc10","sha512":"881b24c161f8ba6a46bb3c19732a5a951e1e1569cda53d9e456291924bf90b66afa16442d813517fcafcb5329f9285fce0835c7e76522453e571e379a32e6e04","ssdeep":"96:uVuFCNwpmvpE9GzPnREyt9B6a7DKmQ6nSqmWxxO3:EugvveKPREyfB6aBRGMC","tlshash":"aba17d97a28b3673c5edb1b2584004e663229326325ea2ec9b162c0fb6b0303fc506d9","first_seen":"2025-01-22T15:28:39.222916Z","last_seen":"2026-07-19T01:02:47.462914Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1885,"timings":{"blocked":803,"dns":0,"connect":0,"send":0,"wait":1081,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midasx.specialfor.za.com/","fqdn":"midasx.specialfor.za.com","domain":"specialfor.za.com","tld":"za.com"},"ip":{"addr":"43.160.250.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-20T12:18:59.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midasx.specialfor.za.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 15:04:35 GMT","end":"Tue, 14 Apr 2026 15:04:34 GMT"},"fingerprint":{"sha1":"A8:7E:28:CC:65:CC:16:0B:81:54:D0:BE:A2:E5:A1:1B:8C:13:CA:94","sha256":"E0:71:24:37:45:1F:2D:76:DC:BA:27:3B:72:B9:99:E4:A4:B6:D4:BA:25:06:EC:22:C6:AE:96:8E:A5:36:88:86"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: midasx.specialfor.za.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 545\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Tue, 20 Jan 2026 12:18:58 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"jsDelivr","description":"JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.","website":"https://www.jsdelivr.com/","common_platform_enumeration":"","icon":"jsdelivr-icon.svg","categories":["CDN"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1355,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"7746fc936e7b4570c1c40e9b1824a9b4","sha1":"af892cd4d4dc2dfc950c29c1ee770ea2bdd2eeb2","sha256":"37141c81e9b4f4f4e670764a358c39f7379046aee7c7d64baaff9d431f3b8c9b","sha512":"7439773c0158e0657cd44b666f2d37274b79009a12165b2c0e7d823303052828b9b0e7464f396f5d2f7ca4ca9e5e7f7afe70827925928dd06843a10744e6543e","ssdeep":"","tlshash":"752102a329625c1c0230d37425f7b098d65b449373611a30beec3a4f1fe1f92c8a7b96","first_seen":"2026-01-20T12:19:47.911701Z","last_seen":"2026-02-10T22:46:25.453715Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1040,"timings":{"blocked":425,"dns":46,"connect":184,"send":0,"wait":190,"receive":0,"ssl":191},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"midasx.specialfor.za.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"midasx.specialfor.za.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"midasx.specialfor.za.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/4521.6f6cf9bf.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/4521.6f6cf9bf.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 9853\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:08 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jt4DsVk5xiQJS8DoumVKsUUImqx%2FWjeZYwqgE7iKLLlf%2FhcklcaY4ajaJbXJOnkRgT5NbVzIok00yHrgdvD0H8F0uxNoei%2BE6tLdQNQCYZ7UJRjP2mM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a2a058deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":51424,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"a87015e3c8de7dbef9d85d969a9695dd","sha1":"29d8d18bc8155b48a5a6569a34eaf84f4c66239a","sha256":"d05ea5bf4619db5a2582b1b7b60f26dd9125d56a33d4f48683aaa827849092ea","sha512":"42161c98dbefd12996ec533ad58ed5719dbac5c11c42a07a35615c38f922c8e1486f4410fdaaef2eec4a804f9515e29e8441e0489be75fc8a091a85eee470ecc","ssdeep":"384:Ka85FP+6kEXwEHCpSqTq+JdIlOJmqyi9bik5PyoaLNEaop3Rd7FHBJatGfZyfweC:ci9qbMmqyi9bik5PyoaLNEaizLEX60S","tlshash":"01332e7ea7017ac593b952e0cba67264e7d4005b63021c287adc2f8d7f720ec3d559ea","first_seen":"2026-01-03T19:33:29.771673Z","last_seen":"2026-02-18T03:17:17.985774Z","times_seen":8,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/9552.808739f4.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/9552.808739f4.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 7303\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 27 Jan 2026 09:58:38 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eRrdLzNBCIDXk3rBIaDK2SEmM%2Ba%2BF3Af3GKQnO3pkNtGgpV0isb3kJsDX9QV83TQiokzVW1YLFoOjwBpK6yGplz8kLG805JHz1oBZa%2FxhZXcxEhO2Q8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a4a628deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":35127,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"635a1c0b09a227ca31bde93350a34a77","sha1":"51f2032165b0ff94b09f27902207683dbb7f9a1a","sha256":"c5822b9cbdc9125104a70fb1bf3d67403795b43aa7893825d35b8aec71736ebc","sha512":"c05f9f565c04c87897d5ea2a0346342c6b38af894da443e7d980b3374559498933f12461be7942dd4f43b0d0a4a2594791a18d0933effb9ec09f401e28eecf73","ssdeep":"768:hNCnKi9q5nizxJ254lLM2m5SDgKRQyxjwo0iTyAJ254lLrdj:hNCnKiQ5nizw4lA2m5SDtbTyJ4l3dj","tlshash":"37f24f1c8bd31826eb7edb9a9b62750adbb71813f7411b7cbadc24490fb85a42050ddc","first_seen":"2026-01-03T19:33:29.782376Z","last_seen":"2026-02-18T03:17:17.987761Z","times_seen":8,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/5.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.167Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/5.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 49778\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HnId5i4nCT92peiGhzLug2h4%2B8wP%2FX38P5%2B8Q%2B5JRwQCUsy9R0TDSW6dUs%2Bp9DgZCvpFcNG2jYcoGdRX6qYtg72g1U5sLdLRGnlEdOQqMqOj4NhJM9o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b4d438deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":49778,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"eeb21bd900bea5ccf870fbf43c00fcba","sha1":"f09ad928f9a3d8e30608799f3ea5793710b8d36d","sha256":"3ba2f30ba003cb01bcbb1d7503ff9ae176d2f811fc245ec773f3718196a546f7","sha512":"cd044569e2fdea4c045aeb82d55d071a91c3cdd72446a5d00b682bbe7e6ddd1013504a76cfdd138ea229ceb1fd6282aac8ed92e9e96297c68de7856fe7818cf9","ssdeep":"1536:13QUNEUjnhMfpOW6ueJVZIZ2ipi+LymG7MA0TJXogWn:1zEUjhuiKsipf0M9TJoJn","tlshash":"a92302fa6b3c1e0a65d1e472bee4b3e34469b51de13e4c76196fc38dcb9d690460d102","first_seen":"2025-07-27T06:58:26.743384Z","last_seen":"2026-07-13T07:27:36.477637Z","times_seen":19,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/6uS9psN.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /6uS9psN.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Sun, 19 Oct 2025 12:15:03 GMT\r\netag: \"4e5d63bb0d704a3940899534c04521fd\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: HLC3tggPXXKNeQRtnLTtHVE4jKv5Dw73-2Ucj54-L2pWmVbSCuDojQ==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 2014485\r\nx-served-by: cache-iad-kcgs7200072-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 149, 5\r\nx-timer: S1768911541.115134,VS0,VE0\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 1914\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":1914,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"4e5d63bb0d704a3940899534c04521fd","sha1":"d3847f3cf1d6c97799f206aa597e33c39f927fa1","sha256":"99fad11fbdbbf696bc9d0431eee914ff24b9f046929867aa7d225d6dc6ef3791","sha512":"4402fbb88ced8f52edb2aa270fb653006c44ac219c11d2a0a1b44fc83d45f5c5ca952086c6f59c0f18eb7442d371218ea8058e97d6e98fc680b2232dc8d2da83","ssdeep":"","tlshash":"f84119e3d7d948e8c112a93148fbc75976a50f3e6838c194c5d088bc912ac76a9c0fa0","first_seen":"2025-12-13T04:44:10.864317Z","last_seen":"2026-06-09T03:21:52.007759Z","times_seen":17,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/css/twitter.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.982Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/css/twitter.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 1081\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:11 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ei2jTmYyzrc6SPZV3WXtnuzmd3dZVCphcXSZMTP6T59A8rR0XjJWqMX5QY3jwHJ0bi2QBn5LKrKzexL%2BJ%2BsTsVDgJ6phrGBxSLJ2kK%2FTZ3%2FeB3Jjqxc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a8b4e8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":6451,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"45e7f7f91fc9fe870757838a4b297eac","sha1":"1c3c665b1e88c2ac85979c10dbc605847fc17dc5","sha256":"d30e1b758d21598f80faf0e89a43d2340e2b7ff26b030a0c3dc169d6e65168e3","sha512":"2ecc46cf2990362a345b98eb383051e8f1338023d448371643b5896f9ae59af9c65d862f57cf86ac3e9d2c6d36b7d229d8950ff2d6551a3df958a22693c0a3b9","ssdeep":"96:/acJ6M6X4zezulFW5O8KZfkli6AOYNHA8VoIoV0:ScYrOlFqO8KZMli6AOyAWoU","tlshash":"a1d1fca79f221508f502e8f8ff66ab9a66094013534fcda7ba4c361ccfc659847b274c","first_seen":"2025-08-08T20:20:25.023305Z","last_seen":"2026-05-13T19:15:32.30572Z","times_seen":18,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/css/facebook.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.980Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/css/facebook.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 782\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:08 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WSaf%2Bp4QW7O1N%2BS3I83l52dWFPbXAim%2B92Bl71gjxHezhbhq8arkQkhnDAfs6rgQJj5qFkkGdYpNgx8xDo4CsKEA47EjiyPQCjSXpgyQJMoYpVLRiRI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a8b4d8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":4168,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"90c5820b3f23970aa0185904a11ff81e","sha1":"86b9c93afafee85c2b8725db333b7ab9beee1695","sha256":"9f7e4b35f78420cd9d66ec71fb534626b30112ad2b67450a821a776329759630","sha512":"8981e2808c4f014d0bc5c1230b0db5cc32209208e3554a400ebf70a4749486b77e7c6c50489c3321eaa2af59c2ba727592c8aa1a2687e3b6495bab4713fd3e04","ssdeep":"96:edqVQtm5HFKGF5bMFjaeGSFeiFeCFIKFp6J0XKYZ:edqVQtaHFKGF5bMFjUSFeiFeCFIKFp6i","tlshash":"4a819b962b670548f511d8edbf952b8bb20e5823534fdc5bbac0705ccf865a886a374c","first_seen":"2025-01-23T11:42:01.066514Z","last_seen":"2026-05-13T19:15:32.241969Z","times_seen":13,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/abb7da543aad342e9b543399b4f44a51.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.315Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/abb7da543aad342e9b543399b4f44a51.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"0f0b5f1b689ff5f21e47e0cfe3098120\"\r\ncontent-type: image/png\r\ndate: Mon, 20 Nov 2023 15:03:02 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 17445457594453902977\r\nx-cos-request-id: NjU1Yjc1MjZfNjg4ZDdjMWVfOWI1Ml9jODQwMGM0\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDgyNTE0NDE\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3699\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 6104956355347542674\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3699,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"0f0b5f1b689ff5f21e47e0cfe3098120","sha1":"21bc4b71d70978b3f045ff1e078db3975e7c92cc","sha256":"1354edfd3ed632934e78d9c154210fa1d871103e5ce5b45fa09172b4ea8924e2","sha512":"f3cacb787ba52d05d7ed82f3f6002c5f0873a3d349f52b19794802c7f42b69798fcc20d4503c223db763a22d21ed368dc8b16d7c7573bd417083fbbb59bcf89d","ssdeep":"","tlshash":"f0713cd268ea62ccb761c63040b0db01a6286ce80e2a893bacb75df55051595f96d1cd","first_seen":"2024-10-30T20:47:39.014083Z","last_seen":"2026-07-19T01:02:47.590898Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1528,"timings":{"blocked":717,"dns":0,"connect":0,"send":0,"wait":810,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/BwULx5P.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /BwULx5P.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Wed, 26 Nov 2025 17:12:01 GMT\r\netag: \"ebecf3f037fd5de5a07a28b3a3ae5fa0\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: PHL50-C1\r\nx-amz-cf-id: MIuA3wSkv_5klfvjgZCSJArd8kTvah5kPxyKWEXvBegDKMihL2nfRQ==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 499808\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nx-served-by: cache-iad-kjyo7100104-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 29, 0\r\nx-timer: S1768911541.141076,VS0,VE1\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 11686\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":11686,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"ebecf3f037fd5de5a07a28b3a3ae5fa0","sha1":"c777ba6aacbc7316e707c6dbd65d9554fcd6e8e3","sha256":"318422597ba674e1a550acaaa4e3f0e1dd0b2a6362b2b31d8916cbf22e0d6f41","sha512":"ea9244d348a981b0f66aaf29d5351f93cf12b77783c8392d84eb04627e4cef93815684a890db1364f4553b9514a18b036cff61854d525500a750b41fc781178d","ssdeep":"192:koI8X7Wsoag3y8JDrS7zVrozL7KF42cF6R7UJR6wiCv521MqhPEHa8f5GSpc5teJ:xo53zJDmBrcHKF42G6i4Cvsp07f5GK4Y","tlshash":"7632bfe9d3a38eb782e501257c34405f92d73b2208d7ced961c27b34fc3ada051a21b1","first_seen":"2026-01-03T19:33:29.677537Z","last_seen":"2026-02-10T22:46:25.338015Z","times_seen":5,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.midasbuy.com/oversea_web/static/media/bar_bg_m.5561b110fa7cb24b096a.png","fqdn":"cdn.midasbuy.com","domain":"midasbuy.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.564Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.midasbuy.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Thu, 17 Apr 2025 00:00:00 GMT","end":"Mon, 18 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"36:C0:42:2D:03:4F:38:58:E6:A1:2A:40:FF:E0:C8:99:CA:D5:21:99","sha256":"30:85:DB:98:42:24:54:F2:64:05:32:EB:ED:AD:83:0D:25:C2:2C:34:27:EF:72:1D:D1:BB:C6:C7:B0:BE:EC:36"}}},"request":{"raw":"GET /oversea_web/static/media/bar_bg_m.5561b110fa7cb24b096a.png HTTP/1.1\r\nHost: cdn.midasbuy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ncontent-length: 0\r\nx-nws-log-uuid: 7589837194985033172\r\nserver: Lego Server\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\nx-cache-lookup: Return Directly\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/login.1b93034a.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.903Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/login.1b93034a.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 23580\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:09 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LethSP9lGZ9Bc9lTs3qMQS4T1uIXfGAd97X9SWqXMs86fxbSkjpKgqFEQyaG6S%2BH6Rfl%2BWTC%2FG2z%2FicrF70S4k2mkRxzHhPfClAhR5PxWFSPIONvZ84%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a3a3b8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":129232,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2425), with CRLF line terminators","md5":"2511b00b370f89319ae7e78d2b6cd90c","sha1":"0dc64c83c78a575c588ebab44ded881933d60968","sha256":"e3280d7adda31c02a3b67ea3b67e69253a9390772fed0994c8bf1f3310d6f20f","sha512":"cadddc2b573cfc412d56ca8f6ba0985544a85a0fd0ad63736b49d17e91947eb276a2694a8fffe05485332829565f91f1b9500be54fd602fdc444af43c1867fe2","ssdeep":"768:pVNCa59oagNEnAjGuPZW2nD25GEGcGhGwezuE77WFc/Ig9MqKssqR7chGLPPjTsm:0C5gyASuPZWCDhej92cRv5B","tlshash":"24c30924aa226c8965371f38e7f90219ff15a4e349421d79bfcc63450fb69bca250f8d","first_seen":"2026-01-03T19:33:29.81102Z","last_seen":"2026-07-23T22:44:16.96141Z","times_seen":10,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":223,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 13 Jan 2026 22:16:05 GMT","end":"Mon, 13 Apr 2026 23:15:55 GMT"},"fingerprint":{"sha1":"D9:00:47:77:A5:47:66:A1:6F:DA:EB:4B:BB:BF:67:49:BF:2C:A4:75","sha256":"07:A7:3E:4A:B2:9F:0A:07:6C:78:A7:7B:DC:2B:68:A1:84:7A:7F:1B:45:6C:71:8E:5E:79:F3:11:1A:6C:4F:62"}}},"request":{"raw":"GET /ajax/libs/font-awesome/6.4.2/css/all.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 18778\r\ncf-ray: 9c0e848aaea456a4-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"64cac444-495a\"\r\nlast-modified: Wed, 02 Aug 2023 21:01:56 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 445464\r\nexpires: Sun, 10 Jan 2027 12:19:00 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=RY8z%2FK3JDQ2kTaWufJDh4G38yEm7XAxYugjBq9TAsA54DmiyF7av16nzT5kDVuxMRetAeUfSDk4oWjnhPcMaGRexavg%2B884bKpg9%2BzXXRNOgkF8Em2LUFCVA%2FYZLtpIzFb1upndy\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":102217,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (52276)","md5":"5222e06b77a1692fa2520a219840e6be","sha1":"8b4236206a8b86af3761a244277663046d7ff7ee","sha256":"0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5","sha512":"cf780ba5def29277f562835b0b3a9129ce2aca8afc81a294d6a9a7f824a1c5bb81bac00d23d42946884606b7821642b12e17a2e92f424171446db2aea8b8340c","ssdeep":"1536:0wMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPGuuprrlCq:M709gMGFiyPGuuprlCq","tlshash":"09a3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2023-08-04T22:28:10Z","last_seen":"2026-07-27T00:02:47.2991Z","times_seen":46149,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":1,"connect":2,"send":0,"wait":16,"receive":1,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css","fqdn":"stackpath.bootstrapcdn.com","domain":"bootstrapcdn.com","tld":"com"},"ip":{"addr":"104.18.11.207","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bootstrapcdn.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 05 Jan 2026 04:32:06 GMT","end":"Sun, 05 Apr 2026 05:31:55 GMT"},"fingerprint":{"sha1":"E4:3E:65:D3:05:EF:8F:3A:11:69:6A:52:FE:6B:BB:A4:DF:73:4E:E5","sha256":"B9:7B:F7:C7:4B:6E:66:E0:D7:DA:7A:8B:0D:2E:8F:2F:E9:28:B4:AB:91:95:86:14:DF:44:15:CB:39:DC:EA:41"}}},"request":{"raw":"GET /font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1\r\nHost: stackpath.bootstrapcdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncf-ray: 9c0e848ab8010daa-OSL\r\ncdn-pullzone: 252412\r\ncdn-uid: b1941f61-b576-4f40-80de-5677acb38f74\r\ncdn-requestcountrycode: US\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=31919000\r\ncontent-encoding: br\r\netag: \"269550530cc127b6aa5a35925a7de6ce\"\r\nlast-modified: Mon, 25 Jan 2021 22:04:55 GMT\r\ncdn-proxyver: 1.33\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 08/08/2025 01:16:56\r\ncdn-edgestorageid: 871\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\ncdn-requestid: 9254252f87a2d3373009efd9d15a7475\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncf-cache-status: HIT\r\nage: 538617\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":31000,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (30837)","md5":"269550530cc127b6aa5a35925a7de6ce","sha1":"512c7d79033e3028a9be61b540cf1a6870c896f8","sha256":"799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd","sha512":"49f4e24e55fa924faa8ad7debe5ffb2e26d439e25696df6b6f20e7f766b50ea58ec3dbd61b6305a1acacd2c80e6e659accee4140f885b9c9e71008e9001fbf4b","ssdeep":"384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf","tlshash":"78d241e8e54c01d66731c48bff81b36862b6fb3dd5854da9f01f290c29d226522c5fba","first_seen":"2023-04-05T03:13:25Z","last_seen":"2026-07-26T23:51:00.38496Z","times_seen":302949,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":13,"connect":1,"send":0,"wait":22,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.333Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:07 GMT","end":"Tue, 03 Mar 2026 17:10:06 GMT"},"fingerprint":{"sha1":"82:59:95:33:5E:76:7F:3E:5B:45:F4:CA:83:29:7C:B2:19:B0:A5:C0","sha256":"A1:28:19:D2:C4:EA:69:3E:6D:8D:7A:20:FC:3E:A6:13:BA:59:C5:9C:DE:7D:D1:25:3D:35:68:98:FC:47:82:9D"}}},"request":{"raw":"GET /ajax/libs/jquery/2.1.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29671\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 15 Jan 2026 00:46:22 GMT\r\nexpires: Fri, 15 Jan 2027 00:46:22 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 473560\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":84245,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32061)","md5":"e40ec2161fe7993196f23c8a07346306","sha1":"afb90752e0a90c24b7f724faca86c5f3d15d1178","sha256":"874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4","sha512":"5f57cc757fff0e9990a72e78f6373f0a24bce2edf3c4559f0b6fef3cf65edf932c0f3eca5a35511ea11eabc0a412f1c7563282ec76f6fa005cc59504417159eb","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa98:7NMnJiz6oAQKP5a98Hrh","tlshash":"db83d6d9b2c67062977730b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T23:24:27.534542Z","times_seen":59785,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js?","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:03.049Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js? HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:03 GMT\r\ncontent-type: application/javascript; charset=UTF-8\r\ncontent-encoding: br\r\ncache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public\r\nx-content-type-options: nosniff\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=R7uPG6d7bTXNW5%2BiKp9KhHe2S9Zr31t%2F4ROT7krsxmTf6LfJJxlP4BTCiwFSQa8PgaKWlx8fBIXr6FdmE%2FpxsKZBKIkv1WGhk2se%2BI2OCtpUvIOdLUEg%2BA8PlRCvfH3kJU1U%2FnwYNDY5\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nserver: cloudflare\r\ncf-ray: 9c0e84980b358deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=3483\u0026min_rtt=817\u0026rtt_var=3227\u0026sent=2330\u0026recv=122\u0026lost=0\u0026retrans=0\u0026sent_bytes=2604928\u0026recv_bytes=26358\u0026delivery_rate=23354239\u0026cwnd=800700\u0026unsent_bytes=0\u0026cid=325bd89cd8e58b8b\u0026ts=2369\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19174,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (19174), with no line terminators","md5":"7198f76d9cb882e53390bb18093e1aee","sha1":"a97588209f94b778d27ec5966825e9d8494d8372","sha256":"4f699714f7c1749b9dba45cacad91add4cb39273ae141691e87c52fddb962937","sha512":"20b98c9882ad322493be838cf52cfd4f91447630382ec3595aeccef2534c2a9ae6cfeeba8b34c1835da747e90b1b7a2c64fe314d63eb7ebff4ecb96efbc650e2","ssdeep":"384:OD+cku3iUwsAY2tF6UepI1nCQcuq+1DrebsbUDrHPbNhfRWnPTMeqLYWwC399NX+:2dkNsAY2tpCQcuq+1DrebsbUDrHPbNhA","tlshash":"758284d63cc6766e43aa30728c6b35cff16e6dc174240805821cf8e8bdb677991a7e58","first_seen":"2026-01-20T11:44:57.113482Z","last_seen":"2026-01-20T12:27:45.750441Z","times_seen":7,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/6437.a65425a1.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/6437.a65425a1.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 7092\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:09 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=w%2Bkn%2FVySHnLgwkNOAFxB9jmZ8zbhfJK8gVgj3jCfNB0xX%2F9cpF9qPaFtB4JL2FYWSr84b9I5O2adZDRRGwUUW1VOwxbs2fEzaDhdRQn2BVKKWPOvT90%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a5a988deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32871,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"899aefa2a52b4bbf06adcdf53e55d956","sha1":"bf3b3302697adf460fe6c2758f94e3c594c5f2cd","sha256":"9b869898974aa9199e4cee7c313919fce284d96b49d7de84e16b728f28b82c41","sha512":"ced0bcc4de6cefce60afbe99734ed537bf13ef4d22db7347d375dd02a9d56d470e343b223e41bfadc7292b6c3d7088c764060cc7e6b32b6848e910974e7742f6","ssdeep":"384:y0m6f1EXztn6wEHCpSqTq+YY6ZNO3F1Maus80BeiPT72HHhrNQ:Li9q06ZNO3g/s80BeiPT70HhrNQ","tlshash":"39e2aa1bb41239ae127ee995db734dbbf600941369c58554f9cc2ae60f6207e70c3be8","first_seen":"2026-01-03T19:33:29.819395Z","last_seen":"2026-07-23T22:44:16.962558Z","times_seen":10,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/not.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/not.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 9102\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=t6vEA5ngfXdik7fgAt4D%2BoTzg%2BzietqtLSGeOPULXzAVBJ8e0Xgiq4rt4e3caht%2B5NeY1ipjx1blAB1dMOhUywB5s5Dq2VO8tEGM28zQgMA1n%2BeJ48Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b0c888deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":9102,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit colormap, non-interlaced","md5":"3b92cd43b4fc725b4507f16fd6dc5fe7","sha1":"fc0dd8c7bc7ba29a736201e71f4d5f26080107df","sha256":"ebaf9d84c413c369027f1f0d5106ab93d277bb79e9c99fc8cf81a976a5cf505f","sha512":"3351d33d34387a20e3e4d39663b353d1ffd3eee8443eecafa2b85891a1f347ac21c139993b950dfa7638de21fe9cd51fff0ca94a81bcda6a3f8bb7c4cd7050ef","ssdeep":"192:o0BUS+floXHAJVFhiSSY7OsvyXcM3UNHV:o0BUpGgZS2vyTwV","tlshash":"c5126c84f6b3d3d65e85265c37e8d1db18824cf162bfea9ac31c4e4d6294819cbc225f","first_seen":"2024-02-23T10:51:04Z","last_seen":"2026-07-25T23:58:14.631648Z","times_seen":71,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/tokens.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/tokens.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 29942\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NVpo5JhZ3YL22xO8YT8PTs%2F1LABM01QFfbgJWHQIOCuFzZqzbXQB7bON0hy43qHpLqI%2BzlPqnum72UQfJxhjte7pda%2FamqqhXg9HC%2By2tuwRK2WEOSc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b1ca88deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":29942,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 135 x 130, 8-bit/color RGBA, non-interlaced","md5":"d02c9d4d558a113e2aebd45c7d8237dc","sha1":"edd72f80a319adf3fec2f3f061c1b82d6bf59aa7","sha256":"7fb8131422bba9cda088005359870721b090dcd043d3cea030367be68c6328a6","sha512":"81fc37e296d450d71c8581bc49d681546fa6e5a32456b9e9463fc97ef9d4013f95476b521b3298c48fca2f93e5b3b1e08050d44e2a40a366c18ff81ce330cacc","ssdeep":"384:d8lsNP0aaonUDdKzrxQFq++i1gPf/DLKnNjSTqSph9WfdNo3pl1U3VieMlgNfWk1:d8+NP46CKYR1gPXW5STvBWFmRaLegNf7","tlshash":"98d2f1421cd2d07e2a4ba7ef8efd337f9a2765710068ead4b299dc1b003724a75e5970","first_seen":"2023-04-30T19:27:11Z","last_seen":"2026-07-25T23:58:14.651802Z","times_seen":282,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/mat.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/mat.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 31684\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qtQRhYXfWq1Ja1X5Te4%2BwJTm3gkrE5Pa7RzoLTzLiRFDM%2FFDEJa7h2wUKbgogU5e46l6FhW7lLGEXJGBjg2KxCDEAiZ3STAEhBTi7kPqx6e5h3KBUFk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b1cae8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":31684,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 480 x 480, 8-bit colormap, non-interlaced","md5":"47e319e666f1f077cf0bc05d091e32d1","sha1":"81c4cccff9ef7f572b937181cb1ca0882d0971d8","sha256":"eafb659956d8b8d934a53ac600ebef96cd018248b72bf8c1c51aa3e966be384e","sha512":"ff962e94b463c1bf5261de6486f32ec1b3e5833d007283eeac24fdc9d00dd6e15212fa86190d7d2a27844620fcfcf6da6df2aca8465a96e4cd9c3d008af9a907","ssdeep":"768:fGNJWRw04iO7eSWOuQ1zZ2MecJ1MPMIAxBDOPj:fGNJqwDiO7efObz0EJSPyBWj","tlshash":"dee2e1e540ccc294d6e99ab4d740c4f95f086fc1a3172514554c9022acd9fbfe4bbeca","first_seen":"2024-04-29T19:19:01Z","last_seen":"2026-02-10T22:46:25.402742Z","times_seen":48,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":185,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/6.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/6.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 32687\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=69aht1YDIWUXWrD9G%2B80gE2PlGEicUuR%2BukYE%2FTjr5ajnXyyOQ8cPuOarqLigvFyrBUFKMw1gYTY%2FPVDufh9uEmRlSUknmpCHmXo63hDrCGsJunYovo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b4d468deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32687,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"21851fa8822ff45c35624137272aea57","sha1":"285bfcdcc9322f7a21705daab0fb0005eb20717a","sha256":"e6e03af2a1beb4eb00125737692b72823218a29d935e794ca0a041ad3052564a","sha512":"157a21013db0d9dd01ba2c13cf87d2326d3509f2a984a9f213069a5376c4cd8617b7cbbd56ea54f50fbefb0d5d5b00fa6681a6ea301719b44a818518571184ae","ssdeep":"768:nn6+ZlH96SDDrrV1pKjdwZ0lnuhJ8rOlcoC0IZTInv3JhLipW6s54/pcbUzH:n6+B6SPrrydOmnOJ8r8cJ0X/Jhcq4RcA","tlshash":"48e2e1f49cf1e3229c6b1a8969b8c4fd0581647827f185183478daa3c8b934da7597ce","first_seen":"2025-07-27T06:58:26.71047Z","last_seen":"2026-07-08T10:56:42.769115Z","times_seen":29,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/ZPTZ9kw.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /ZPTZ9kw.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Sun, 19 Oct 2025 12:18:59 GMT\r\netag: \"7b9d182f166822f3dafba34257c6a1f4\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: R9NxYnJzJyN8HinD8WniFhhYqmjVQWF4tZZIMmN8XGgKsjMYRNKRlA==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 2411039\r\nx-served-by: cache-iad-kiad7000041-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 189, 8\r\nx-timer: S1768911541.127098,VS0,VE0\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 4871\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4871,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"7b9d182f166822f3dafba34257c6a1f4","sha1":"686fac74d930520f6a16ed8102911810766e4a49","sha256":"f68ac3186413bc57d4ee849beb5bf8d7de91c28bfde7cf624bfbc0f9ea32b385","sha512":"b0a01adc2f9d3a5714628b493eab7454c96fa614bed0c27551dddfa35020dd9fd28ad8a9a2fcfa958bd0d15b2b9bc447dc8d4da6ede0c27cf1bc0b8d0c2b7355","ssdeep":"96:Uz9i7VBOotQmzSbwOjAvJ2JKE3v1sqhmtTRlS5v6FHEWs6DdFVYyl1:U2OuzSlUh2o6SEvsk3oPNz","tlshash":"51a19fc73d2cd196ca270e0139292d3219aacac47e397e3a81fbf1f6195380803d7803","first_seen":"2025-12-13T04:44:10.797314Z","last_seen":"2026-06-09T03:21:51.990136Z","times_seen":17,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/5012.b5b75575.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.844Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/5012.b5b75575.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css\r\ncontent-length: 5447\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:09 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YehrrlnygTBpnz1mGElK1KzwOqveGjHbq6tCVXKYdj2CLj6wdy9nJQkyeFMDwZGV0K6aJ%2Bw5vV5NVD2fWPtZxPY50eU7KzMAgq1VQ6St8wwmaibwhtg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e8489f9a18deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":35165,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"36c016118d795066e7c6d8f239984d91","sha1":"bb3ece082ba8bbf1462e43ecdd57f55dd8e7a1b5","sha256":"a425de84bdfb9aba3657f6ea4414519a802c20ce4981d71da3f920e3d90f25fd","sha512":"3fcedafb817e8c05395d44ac0b2cb0a8da5b6956b5cd984f8567629ec8e78ad5b494d76d56d3d1646853e2cc0810b80b3cd63bfc841975eb4714341b9aa442aa","ssdeep":"384:PMTuI6vItwEHCpSqTq+/vSj7kCR9CwEHCpSqTq+g:6i9qci9qh","tlshash":"d8f29395df21189e1677dbb6db7b408bdf082623a74223397fcd57871fb02a49004d68","first_seen":"2026-01-03T19:33:29.717708Z","last_seen":"2026-07-23T22:44:16.904713Z","times_seen":10,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":217,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/m8BQB4k.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /m8BQB4k.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Sun, 19 Oct 2025 12:13:11 GMT\r\netag: \"cdc14977c4db2201b46139088307d5b9\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: 32VOkFRve1Sk7lF9tBHTpkgUcehLqXbI1GjGNUhRIc2M218rT09Ofg==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 2772841\r\nx-served-by: cache-iad-kcgs7200044-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 388, 47\r\nx-timer: S1768911541.114716,VS0,VE0\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 1737\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":1737,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"cdc14977c4db2201b46139088307d5b9","sha1":"da91a698dd100ba6fe6aecb53c2b406531a0557b","sha256":"fe26edd8e0c61e8f80bdeb5486a562e228bbac2590f92a13edcdd24fd6587dd7","sha512":"a77f6a75176cd1661cc41ffcb2b4353d4f49bce8ab8ae462b86df26b30a0cc24aa366333b546103e89ae0f0ea94df5c91f96ee8f871d603bd7295c3361effbb7","ssdeep":"","tlshash":"3931e9b70d76293eee4a3031d285fdb0fd08be4aa6a24299425b4c64d69aa995190443","first_seen":"2025-12-13T04:44:10.870063Z","last_seen":"2026-06-09T03:21:52.000979Z","times_seen":17,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/5cd68782d589758bb880d656abbd3a1d.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/5cd68782d589758bb880d656abbd3a1d.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"af6e8ff285587d9b614041376dfb4f3f\"\r\ncontent-type: image/png\r\ndate: Fri, 10 Oct 2025 03:36:04 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 9135806937487741942\r\nx-cos-request-id: NjhlODdmMjRfYmJlZjc4MGJfM2JjNl8xYTQwYWE1OA==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc2MDk4MDE\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2950\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 5832578597442827064\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2950,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"af6e8ff285587d9b614041376dfb4f3f","sha1":"1b505bc42dca7af4b70320288f461f4d966d321b","sha256":"4789f7684065c72ce12eef05ba82d6dcdab7d163b5f2ce0bbf5222f181b37820","sha512":"50b64cb12c5a44e726819ad1e7f42b184e0cd45e3043affaf317b8f93cf82f8380bba246b5eee1d57dbfbe904fd46f25bfac12647d9eb932ee7ed063b11caefd","ssdeep":"","tlshash":"54513b820b7c4fbc7dc98d77ff18a56b52d187312fb83021b551ab4a51dc98b1ae4a10","first_seen":"2025-01-22T15:28:39.199935Z","last_seen":"2026-07-19T01:02:47.507212Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1592,"timings":{"blocked":822,"dns":0,"connect":0,"send":0,"wait":769,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/29cf13fc540e0c2c10422541aefee49b.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.408Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/29cf13fc540e0c2c10422541aefee49b.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:22 GMT\r\netag: \"717de2603d3013e3d04b14c96a9e6416\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:36:36 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 4929961802656818551\r\nx-cos-request-id: NjZmNDFmZjRfZjgxNTc5MWVfMjE5NWVfN2MyY2M5Mw==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDcyODk4MzI\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 4302\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 6889293129648934740\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":4302,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"717de2603d3013e3d04b14c96a9e6416","sha1":"0a14a050a27cd9377137a9bab6724e88ba120256","sha256":"049539eb341317fa886955f7073079c9f92d1abe4f92b87d942c00d46332fa30","sha512":"bf9bc3f2b82cf63c44e160dce011da3d7c870e63aba1c5948b68e75b6bc8fe99aa1b945f7905718ff9142f6f6530c832ad553a676e0390500d4ba62906bdb87f","ssdeep":"96:P1GuxPpoQyy141hzVdx8I3z9a6x3u2WqRvVGRdT/5tSgFm2G:dRoQf6zVzJjDpuYRvVAtSJ","tlshash":"99912a10363e1b32614ef2253a347d586699108ca72f89919b28e679432e3b270d23eb","first_seen":"2025-01-22T15:28:39.177866Z","last_seen":"2026-07-19T01:02:47.569236Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1414,"timings":{"blocked":625,"dns":0,"connect":0,"send":0,"wait":786,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.midasbuy.com/oversea_web/static/media/DINMITTELSCHRIFTSTD.ae4cacf317c4c9c6befd.woff","fqdn":"cdn.midasbuy.com","domain":"midasbuy.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:03.070Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.midasbuy.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Thu, 17 Apr 2025 00:00:00 GMT","end":"Mon, 18 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"36:C0:42:2D:03:4F:38:58:E6:A1:2A:40:FF:E0:C8:99:CA:D5:21:99","sha256":"30:85:DB:98:42:24:54:F2:64:05:32:EB:ED:AD:83:0D:25:C2:2C:34:27:EF:72:1D:D1:BB:C6:C7:B0:BE:EC:36"}}},"request":{"raw":"GET /oversea_web/static/media/DINMITTELSCHRIFTSTD.ae4cacf317c4c9c6befd.woff HTTP/1.1\r\nHost: cdn.midasbuy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://udgqcvkk.fortoday.asia\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ncontent-length: 0\r\nx-nws-log-uuid: 10078401292135996793\r\nserver: Lego Server\r\ndate: Tue, 20 Jan 2026 12:19:03 GMT\r\nx-cache-lookup: Return Directly\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"font/woff","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/shapedisc.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/shapedisc.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 2654\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jRiJwPdfcAylKzA%2FsmTs6GpBGnfr7Tp6%2BizsQHnnQ3Ekdg6LojDzmUhNd3EHkgcerPbNmq%2F%2Bdb%2FO5xgL6B6dk3gjno4WxmVmmBHcoSQbxRi%2BSoG9PoE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b2d028deb-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":2654,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 40 x 96, 8-bit/color RGBA, non-interlaced","md5":"3fbb4d016bd3a7e7deb7716bcc3cb5e4","sha1":"b5013c5ad4599438d1e9ce89a26c2a7ced31270f","sha256":"83aef7db7b1f536a9355fa29b6a4f64dde789962db28148bcacbb35575987993","sha512":"2b6e14d7b9d799dbad11a56fcc75dc5d20e4f08a2c2a863168137be193bc2c62d39dd1f61c40af4d740f3eff2c92b3d695d8daffd3dc212ced9b4766b0fe3c74","ssdeep":"","tlshash":"ac51f9d4fcc934f9120594662747d394203382dad14334ae299956d8e869c2fcf52e44","first_seen":"2025-01-22T15:28:39.035402Z","last_seen":"2026-05-13T13:04:07.262352Z","times_seen":12,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/f2e1d34f93ad107cc952b7c66c903bfd.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.323Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/f2e1d34f93ad107cc952b7c66c903bfd.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"94a352ea461a1194e6d8c0fd4790e018\"\r\ncontent-type: image/png\r\ndate: Tue, 20 Aug 2024 09:12:47 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 10531465115582882004\r\nx-cos-request-id: NjZjNDVlMGZfN2FmNGQwYl82ZjFiXzM2YmE1NjY=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc3ODMyMjI\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2246\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 9138220568738307361\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2246,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"94a352ea461a1194e6d8c0fd4790e018","sha1":"9e2722de3b50d1e16dcdceaa4730b563345a5678","sha256":"ed290c84e40b717a7f85b4c25ff015758f0b8fe1752cc437f83b36f6914c84ff","sha512":"dae68476055a322964c58e12ca39278aae506898ae0bd58087dc54186e83dc1f3ed647fd5f1b9d9287df70fbb2b58a367ff2a7eba49790625bb891e328b8ded0","ssdeep":"","tlshash":"b1412bd41e4916fcfbf5eaf8138473c924644d2783165e0b08c33681bf99115775ae5a","first_seen":"2025-01-22T15:28:39.238629Z","last_seen":"2026-07-19T01:02:47.538481Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1507,"timings":{"blocked":708,"dns":0,"connect":0,"send":0,"wait":798,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/f269367cf868dddf53a2f5fb46c5839e.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.411Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/f269367cf868dddf53a2f5fb46c5839e.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Mon, 26 Jun 2023 12:34:41 GMT\r\netag: \"b5f20f732e6b6e682834ed01251dd18d\"\r\ncontent-type: image/png\r\ndate: Fri, 10 Oct 2025 02:51:08 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 7863818824923771470\r\nx-cos-request-id: NjhlODc0OWNfN2FmNGQwYl84ZDFfMTljNDhlNjk=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTYyOTA4MjgyODQ3MjA\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3036\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 1530273554455049523\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3036,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"b5f20f732e6b6e682834ed01251dd18d","sha1":"765090392444768db4fc5b4ce661597797e2f868","sha256":"1bbd31380e44dd6da3f306c3074af3e42b83049e5af2e714fa8e39b52f998f32","sha512":"a0aa0c46d7e018e7d042ca299e67829bc9435217e606fa3e74d8aa1452c2b24d07f7fc750640e9e8a13d502c1537b9a3f16096fe855a5abbe8d58811570382b7","ssdeep":"","tlshash":"60515ecfc6ca9d58c67b97588581409174bff28c497f178b022bb582fbb97c62208247","first_seen":"2024-10-30T20:47:39.025718Z","last_seen":"2026-05-13T13:04:07.169303Z","times_seen":18,"resource_available":false,"data":null}},"time_used":1412,"timings":{"blocked":623,"dns":0,"connect":0,"send":0,"wait":787,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/style-img/linkbtn.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.540Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/style-img/linkbtn.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 6526\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ORYrMbmj8tft%2FjmggwdvCQSGvC8wpQJKyxOE7IyIvURwcKG8aNLN39aqjHUeGyVKjpyZAnpKdTQewb8T8QCPoIfDOrCj7D9l%2F3PUGDHIgik%2BMgOWQGQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c1fc18deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":6526,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 77 x 74, 8-bit/color RGBA, non-interlaced","md5":"48c050386aace34c60f16a01fdf74c3f","sha1":"53768d24571ce30d02d038a196cee350baf19d8f","sha256":"b318d6f5d2b095f2ee11e25716a02d4de816c93eb2d0ccd26459e03b65962b14","sha512":"ef29d0f8a69a353a563fcfc2f82d3aacf4a2306e16a61fd4b232365605234549eddfb59c606fc89579a0e0870aad22af993a95e123390a8ddec3bf2fd939a145","ssdeep":"192:1pfLypqJ+wO767KiTf/wpCWAKgNQw9JIn:1pDyY37/7EYSwTu","tlshash":"1cd1b0cf17cb25784d6a279c973a19f2fed310806524b39505839bfbdce0b46d4816aa","first_seen":"2024-01-05T16:39:52Z","last_seen":"2026-07-25T23:58:14.660307Z","times_seen":237,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/index.js","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/index.js HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 2256\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\netag: \r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gliVUV0lXc50TI%2F8Ma%2FkG1soSYKPjZMOT1tYNfrqPJ78taW62uJ4au7y7bMZZ0kkBz79%2B3wnoUmK5DDPj%2FqOvY8c3mdjqIVxSTZj5WgMDraNy9sHJe4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848aab9c8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":8446,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (8446), with no line terminators","md5":"1576c7c8eef31ed7e76bb206ba563e6b","sha1":"8fc4fe74014fcf994321450cab9cc9bd939bee50","sha256":"d0e603a02ad3bbfbb51d0f26841a9dd26023e6ae34b05f8f8562d0f675591d32","sha512":"2877d640a2a46c3f36dc547ebc7a831e9df647bd7bd69d1e9014d98f05c93a20ead75b2497a04270faa8cbcb02d0f3b1d59751ede29e2bb2adf51d0663cecdf5","ssdeep":"192:WiaFhJw3Verhd/bNcpuOoK/bLCY8/G5lWqoKJPcG8NgKDC46LL/08bSDdfb:W1/JJepuOoK/bLCY8/8lWqoKJkG8NgYr","tlshash":"9102c0093ec055ca0b0a76be6e17e4e6e52518ec25e4030fd391b865bbd822fe996634","first_seen":"2026-01-20T12:19:47.95254Z","last_seen":"2026-02-10T22:46:25.376195Z","times_seen":5,"resource_available":true,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"code.jquery.com/jquery-1.10.2.min.js","fqdn":"code.jquery.com","domain":"jquery.com","tld":"com"},"ip":{"addr":"151.101.194.137","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.021Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jquery.com","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV E36","organization":"Sectigo Limited"},"validity":{"start":"Thu, 12 Jun 2025 00:00:00 GMT","end":"Fri, 26 Jun 2026 23:59:59 GMT"},"fingerprint":{"sha1":"56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE","sha256":"9A:64:20:6F:F5:DC:F1:8A:D6:B2:D0:93:C2:7E:62:86:0B:1A:D5:24:CF:CE:4A:9F:4C:0D:F1:FB:F2:A0:A8:1E"}}},"request":{"raw":"GET /jquery-1.10.2.min.js HTTP/1.1\r\nHost: code.jquery.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/javascript; charset=utf-8\r\nlast-modified: Fri, 18 Oct 1991 12:00:00 GMT\r\netag: W/\"28feccc0-16bb3\"\r\ncache-control: public, max-age=31536000, stale-while-revalidate=604800\r\naccess-control-allow-origin: *\r\ncontent-encoding: gzip\r\nvia: 1.1 varnish, 1.1 varnish\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 1041203\r\nx-served-by: cache-lga13622-LGA, cache-hel1410021-HEL\r\nx-cache: HIT, HIT\r\nx-cache-hits: 1, 7621\r\nx-timer: S1768911541.048288,VS0,VE0\r\nvary: Accept-Encoding\r\ncontent-length: 32788\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Varnish","description":"Varnish is a reverse caching proxy.","website":"https://www.varnish-cache.org","common_platform_enumeration":"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*","icon":"Varnish.svg","categories":["Caching"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93107,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (32072)","md5":"628072e7212db1e8cdacb22b21752cda","sha1":"0511abe9863c2ea7084efa7e24d1d86c5b3974f1","sha256":"0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988","sha512":"3aa68568ff2592ead412a0c7f5c39abc37ac562f00b7c16af07cd5eff881aadce77ec71040b36c0ad9c2d2aa4edd7744fa72b0f44cb8b485d4f283b1b49c2141","ssdeep":"1536:L4mCgi8DyCuXXFiJ+L0kJQsJVPEKLQRZdC/RlfDknv+p0WzH/IoSZ7qABZnu0sFv:LGsKXlI2p0WPSbDrstfam","tlshash":"3f93f8ddb2d1b06257bb21bd006f540ff236195e280d8850f129e8eabc74a4d9277fad","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-27T00:09:49.201613Z","times_seen":16822,"resource_available":true,"data":null}},"time_used":173,"timings":{"blocked":22,"dns":0,"connect":14,"send":0,"wait":20,"receive":1,"ssl":108},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/iconmid.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.152Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/iconmid.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 3935\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LZbs37Thtu1iRXEr%2BBebmdF0os0SoUYsRJK9RQae3Lw2hx7RcTs82R3obloReDzbXaenpBq%2BQo%2B7VbHBw3k1aIXBOc9NrMeNNN8ch1nY55%2F0RZzqLBY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b2d038deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":3935,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 50 x 49, 8-bit/color RGBA, non-interlaced","md5":"464a64f6a97263cd4b329b105f445a37","sha1":"cd70fba06d5bb4e225bc01c8ecea7b0b5e03b9ff","sha256":"d125df14feab2b909f364bfcc645a504556a5d2706fd8e6bfaaa23ec5748c91d","sha512":"469e9352c098682ecc394c3eff1ad36e11d5758458c875de543fc11ba10bb19940cc10c0327831160be6ff5bdf5e08d5e2aa51b6a1da298f541e0d71fa0de6be","ssdeep":"","tlshash":"ef817d98c692f0d6b54e49052b276b74c9380132c38fd669c95db02e82ae0bdb83dbd0","first_seen":"2025-01-22T15:28:39.061775Z","last_seen":"2026-05-13T13:04:07.329797Z","times_seen":13,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/HNHYU8b.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.179Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /HNHYU8b.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Sun, 19 Oct 2025 12:18:07 GMT\r\netag: \"57f73f20c0729c30e8d24dff245c2f87\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: DAFWO32MvP9g2NkG4Fl0iGb7yS7WTv34LLj0RgbjQJepu2HYDFhieA==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 483820\r\nx-served-by: cache-iad-kiad7000076-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 196, 8\r\nx-timer: S1768911541.127118,VS0,VE0\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 2134\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":2134,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"57f73f20c0729c30e8d24dff245c2f87","sha1":"0b8a3cdbd457f4a2449910ac56e60faeab4c3c1e","sha256":"497ad6ed6eb64bf83dca7030250c6926a47adafe25a4b398b3b5dde5bf8f1cb5","sha512":"e2be5863eae67d541d5f430f46622904ecd695de854e24f7e127aa7cda6b902c1ba6747004310a4f4dc2c1d2b5adbe54013320a74f259ba8c3d0689412916dc3","ssdeep":"","tlshash":"5d4118efd98ad129266b57b537a4d432ecb291021918561a20904ea3b3f23d85d88eb1","first_seen":"2025-12-13T04:44:10.846333Z","last_seen":"2026-06-09T03:21:52.039738Z","times_seen":17,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/1462f1e033d3e26ced00bfbf97e5086f.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.320Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/1462f1e033d3e26ced00bfbf97e5086f.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:22 GMT\r\netag: \"f000f9b5ce26806ae631389c2e2625fa\"\r\ncontent-type: image/png\r\ndate: Mon, 20 Nov 2023 15:03:02 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 13992276931822056787\r\nx-cos-request-id: NjU1Yjc1MjZfZmI4YzdjMWVfMWQ3MzJfYzg2ZjFhMg==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc1MTg2Nzg\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3602\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 9134470683415024012\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3602,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"f000f9b5ce26806ae631389c2e2625fa","sha1":"c1675268ac4b566c87350177a4d6f985d9d44677","sha256":"649e7a01dab790ea9c63f3787c550739ad0487697bdcc0ca814898a3419460b1","sha512":"6aa63dfea29c3f62f9ea91da6b36fdd4533d624cbd7b26b2ae724be37a5a07a70e75892fe76d6eb1f0cbd022e60a132317d8441d65a46b3817980cf50817b771","ssdeep":"","tlshash":"f4714ed930c41b919f5af9a37d7b64c00b25cb444d9118695fe1b9e21776a0e4b2cb12","first_seen":"2025-01-22T15:28:39.183552Z","last_seen":"2026-07-19T01:02:47.520695Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1502,"timings":{"blocked":711,"dns":0,"connect":0,"send":0,"wait":788,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/style-img/icon_2.jpg","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.414Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/style-img/icon_2.jpg HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 13303\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 27 Jan 2026 01:17:36 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fsV%2FrERJlv1Ia%2FmZD3WXg2ew7mXU5IpS91375%2FxQbimIKvQ38n0f7jueLNFSAANgbW6wTbnoh9WJdcJJzdUXZeCtkaFnffuTbxK9y%2FT%2BobpcMWcVEE0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c0f858deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":13303,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 554x554, components 3","md5":"7c769800798574703b2bee43f5b6c0e7","sha1":"b57395a2544ceed657b00d088004cda7ddbaa7a6","sha256":"15c67df51c82b0b84d5f0173c405d8e075ea4980ec30613178daa32ef976e047","sha512":"7afb2190ebbbada1c016363039d34d7c70259638903d01e351b7f7d49e8af52e9c180d3a6b1a1910d1f4ae09440ddce2fc504ae4773f963e75d8b8865db6b50a","ssdeep":"192:3OgsGP/QVdegrmi9ZkXE5OMfU1kMQqzetuR9pCAJs8VdH6Zj6m7k1sBZj8fc4d:tsG74mSbgMfUuKzea9C8XHYX7NIdd","tlshash":"7752c037bb2daeb6d669b7718b47075deb76ec20439b954683e23121083c1425c1cfa3","first_seen":"2023-12-16T16:31:33Z","last_seen":"2026-07-23T22:44:16.948364Z","times_seen":37,"resource_available":false,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/Snbmifs.jpeg","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.123Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /Snbmifs.jpeg HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 26 Nov 2025 16:04:25 GMT\r\netag: \"e8f8d524e6f24140cc6dbf6c47163ea5\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: 7Pesgi7BqgxxJ0gNGGZPdUuJbboEU7K_CbUMP4iO0xgvjxyhmCfAbA==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 1339641\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nx-served-by: cache-iad-kiad7000090-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 81, 0\r\nx-timer: S1768911541.114549,VS0,VE3\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 184765\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":184765,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1920x244, components 3","md5":"e8f8d524e6f24140cc6dbf6c47163ea5","sha1":"bcf0cfbff8a216381a1f1bf4b755533ac28e09b6","sha256":"49b6488b4a76736fd009bd8cf02bb00dae8f5e62e33551012e7da66798b9c10d","sha512":"f0d918ba227f9281af8104558e56c930f2bdf8b077f939eb14b131031ce1a540af1c4dff5b7fdb20d109bc4f5fd8d52e0f6c837319d6c88f73de9286da94c7cb","ssdeep":"3072:8KL00v7g/a6vJKFrM6589VVd6MdQRMiJm6UBvC/Rcn4a3fHw3sGl2XVhqtYEoDm8:rLdg/+89V3D+UYJc4a3o+XWtYB74A7AW","tlshash":"800412f4b4a4c7c9ab4c7b35d76d2e0fd8b4ceb156881238c1125f6ef1e624a0d858da","first_seen":"2025-12-13T04:44:10.825404Z","last_seen":"2026-02-10T22:46:25.387386Z","times_seen":8,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":139,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/Uw9U6Hs.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /Uw9U6Hs.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Wed, 26 Nov 2025 15:53:44 GMT\r\netag: \"f762239cb3077a90b47f672a1db28004\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: JFK50-P6\r\nx-amz-cf-id: Dr3eLWBnGc0rJOi5XaGmSMl7QdaLHgDnZPgHOoCiJ8XoHVfns_aaMA==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 278938\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nx-served-by: cache-iad-kcgs7200113-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, MISS\r\nx-cache-hits: 16, 0\r\nx-timer: S1768911541.127077,VS0,VE122\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 75909\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":75909,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 220 x 238, 8-bit/color RGBA, non-interlaced","md5":"f762239cb3077a90b47f672a1db28004","sha1":"221cc4238d3b7023a6759245307b271185447d40","sha256":"b70a0b4f049eec20cfb5213fafd40d0e30c058d5702ec6e3f74192e15995a8f0","sha512":"28fa550d8e4869a4dd416116f345bd33a4da8308c08bac15a2ab60c5db1f5d02dd9439bc354fd84f5d9f96845a9179348f0a98e8688d5a2be1931701c7623272","ssdeep":"1536:htwC6oQOqCL1x6h6t8eHB9/LckKN1gS3Cp7X7r5+PopAEbSD:hirFOqi1x6k8SjTKwxVX7rDAE2D","tlshash":"747302d976face296357cb58a0714f52e430df005abd72823b15c778074bf6a09a86e8","first_seen":"2026-01-20T12:19:47.962294Z","last_seen":"2026-02-10T22:46:25.448091Z","times_seen":4,"resource_available":false,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":164,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/1.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/1.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 50261\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Vv%2FzdX5i0k5YhiTU7lYOZNCvkGo24K3w7cOf4jQIwqQBLXNyZx%2FQWE3LOwudVdLqpf4mZpd3VTeMXtjaWG601ds6%2F3mEtkJVCKcSfxdqI1HoBXbrGhk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b2d048deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":50261,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 280 x 280, 8-bit/color RGBA, non-interlaced","md5":"f08658ea211cf8f30e4145da4fb5b13a","sha1":"d0713fcbebce807df818316b23aa1901d16ae520","sha256":"c81e657387a04fcd5108820552a897c98b77d84db4864064643d3c0c0e2c51b6","sha512":"f8c09e9e907b7a379eea07a3ba9925877ef38ee6c433c6158cbb99c9b3044c25e3de5ce5ceaa8cf5857cd5bce22ac0d7e9d4dd1f9012f3ce3c1b9d9bc4e994c8","ssdeep":"768:N9BsopoNeXHaMyt3vyJAPd3jPk6SLM4E93LrMQNcMp55ze9xrM2rptFAA+WHR:N9Bs2oNZMyt3vvP5sQu05WxbraApx","tlshash":"7333f166ed22ceb6ce23109fff0d0691163df2e8e1581bc160bde6ac57061640e1a757","first_seen":"2026-01-20T12:19:47.964191Z","last_seen":"2026-04-02T03:29:17.468501Z","times_seen":5,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/8.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.169Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/8.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 31499\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 23 Jan 2026 13:34:06 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4tyDuN%2Fol6LR4bSbH0ps1%2F%2B5bmF2h1h%2Btjj%2FRsCnvXTMfoSEmgEGRuSNJUy%2FJXlIhR3O8YJyvc98RCprsaoW8bh8avuLCwN011GTQdYBlqewoKSOJvI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b4d4a8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":31499,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"80f04fb7f0292cd53e77452962c64415","sha1":"885fe791b3930312b0462e918b77d1946acfd944","sha256":"749a4b044122f65adcd756b325fac6b2b849d036b007247ffa92aa3680d18f22","sha512":"5a3e69b0c8585383dc1ef5dfc1ee0d7af6a44e3e6bbdf5fe8da191ccded8a86949d42bf95a80ca10f810ba473e803bd70617efb5f11c85da0aca79bb5b8f257f","ssdeep":"768:ccivFiOSz+nf3UU0k9l4NPm/OyRO0K6IezqAo0:ciOScYwQmWyA0zHOAo0","tlshash":"7fe2f1452c04f0c6a3541ffd20b7376fde66af37244c1ca0a282f6fd6e496d74a0a591","first_seen":"2025-07-27T06:58:26.72121Z","last_seen":"2026-07-13T07:27:36.486532Z","times_seen":39,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/style-img/Hide-Password.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/style-img/Hide-Password.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 28029\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6ja%2FyyZhNZNCWBGQ%2FlRCy9Lrq87Nj7USruHM3w0kUX0c%2F9KfboAtxsvrCq6Mta%2FyKiRKpXotiuyYayHlHQM%2FtsnqLkUQOSWk53S8TjMjetvNaK7Uzxk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c0f938deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":28029,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 656 x 656, 8-bit/color RGBA, non-interlaced","md5":"8d1f08b46884df302bf7300fc234832c","sha1":"5735d57b6fa211c400d439095d5ff2f5bb57e691","sha256":"e4cff1f68b85c3343554090b3479273a54e5eed2dbb3e56ceb9f86c4ebe8b0e7","sha512":"e9e6d2c2f0df932daf50f158bad52c4de66fd403a8400cf9cd25fa48fa8147f65819d722773d9aafdcac5bfa4034f5540f1fe7cfb9b37d97f2a700eb54242a89","ssdeep":"384:bYRVO2zHzAUrJJtUOqhoFiXNm3EhiPCBk5u+z+b1o98PEgkVnRsiT3oCB41+ddD+:kjAsJtUAINcEhgCBk5mI60VRcCaqdC","tlshash":"95c2ae37f3a289f37da653727a64511a14714d094abcb95ce4c9ad12fb7c2e43039b83","first_seen":"2023-04-30T19:27:11Z","last_seen":"2026-05-13T13:04:07.317976Z","times_seen":910,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.midasbuy.com/oversea_web/static/media/DINMITTELSCHRIFTSTD.a7bfa1ad62bf8ba2fa46.ttf","fqdn":"cdn.midasbuy.com","domain":"midasbuy.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:03.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.midasbuy.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Thu, 17 Apr 2025 00:00:00 GMT","end":"Mon, 18 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"36:C0:42:2D:03:4F:38:58:E6:A1:2A:40:FF:E0:C8:99:CA:D5:21:99","sha256":"30:85:DB:98:42:24:54:F2:64:05:32:EB:ED:AD:83:0D:25:C2:2C:34:27:EF:72:1D:D1:BB:C6:C7:B0:BE:EC:36"}}},"request":{"raw":"GET /oversea_web/static/media/DINMITTELSCHRIFTSTD.a7bfa1ad62bf8ba2fa46.ttf HTTP/1.1\r\nHost: cdn.midasbuy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://udgqcvkk.fortoday.asia\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ncontent-length: 0\r\nx-nws-log-uuid: 1275653339441566481\r\nserver: Lego Server\r\ndate: Tue, 20 Jan 2026 12:19:03 GMT\r\nx-cache-lookup: Return Directly\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"font/ttf","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/disable-devtool@latest","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"104.16.174.226","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://midasx.specialfor.za.com/","date":"2026-01-20T12:18:59.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.jsdelivr.net","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Fri, 25 Apr 2025 00:00:00 GMT","end":"Mon, 04 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A6:DD:A1:61:65:41:D0:8F:18:9A:2F:B3:5C:A4:20:AA:B2:8C:AD:1F","sha256":"20:CE:80:8C:8A:B7:48:3B:0B:A0:F2:AC:61:42:83:EC:54:84:A8:FA:4C:2D:98:10:FF:8B:FA:A5:1D:F5:21:28"}}},"request":{"raw":"GET /npm/disable-devtool@latest HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midasx.specialfor.za.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 20 Jan 2026 12:18:59 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 6646\r\ncf-ray: 9c0e84839ba40b65-OSL\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nx-jsd-version: 0.3.9\r\nx-jsd-version-type: version\r\netag: W/\"4514-YJEJ2C3rDH3T2dISgI3LoFSM49E\"\r\ncontent-encoding: br\r\nx-served-by: cache-fra-eddf8230143-FRA\r\nx-cache: HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=86400\r\ncf-cache-status: HIT\r\nage: 35525\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=rP1uU87pnlseVxq9euk%2B4owmKqTiHE2KhQRe%2F2PJJP4ig8OIgzcvSna11%2FXavpob9MDSiPzefeu7batX%2B18eofvkrEyKaNZE3A6uKLtCM%2BZzY6wUapKI25Q8TrjEwEjvBuk%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17684,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (17663)","md5":"7fa174926682313cc5a067077b0bb22d","sha1":"609109d82deb0c7dd3d9d212808dcba0548ce3d1","sha256":"5a7b9b2c807f85575c9ebc1f508e849b53430870b2d0fb6c02b2de3df661cb63","sha512":"83a593d4b8648b78031259becd96b4c33226e9462c2e26013ee0746ff58a7b710159d0d380d001d7740e9485ee346491c16e3fdb0d334f5b6cfabe6f90cda9b6","ssdeep":"192:m+5ekRvDLCpBK+BpP78nPk6O9ShgzsqcSYV0GtI+uwicvsbIUiJE2KmnyKU:mLiPCvRvT8nPk6cSCzsqGVJeZcsb8S9","tlshash":"0582c4ccb48270715b77a9e9507f454ab23aae96888c8040f13ed8e42c7c56ec267f7d","first_seen":"2025-08-02T03:49:54.562881Z","last_seen":"2026-07-26T23:24:27.527814Z","times_seen":4870,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":7,"dns":1,"connect":1,"send":0,"wait":11,"receive":1,"ssl":7},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.018Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:07 GMT","end":"Tue, 03 Mar 2026 17:10:06 GMT"},"fingerprint":{"sha1":"82:59:95:33:5E:76:7F:3E:5B:45:F4:CA:83:29:7C:B2:19:B0:A5:C0","sha256":"A1:28:19:D2:C4:EA:69:3E:6D:8D:7A:20:FC:3E:A6:13:BA:59:C5:9C:DE:7D:D1:25:3D:35:68:98:FC:47:82:9D"}}},"request":{"raw":"GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 33018\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 12:39:16 GMT\r\nexpires: Sun, 17 Jan 2027 12:39:16 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 257985\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":92629,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32089)","md5":"397754ba49e9e0cf4e7c190da78dda05","sha1":"ae49e56999d82802727455f0ba83b63acd90a22b","sha256":"c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4","sha512":"8c64754f77507ab2c24a6fc818419b9dd3f0ceccc9065290e41afdbee0743f0da2cb13b2fbb00afa525c082f1e697cb3ffd76ef9b902cb81d7c41ca1c641dffb","ssdeep":"1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe","tlshash":"8c932bdd72d2b03257ab30bd106f540ff2361959280d8850f268d8f9bc79a49a277f6d","first_seen":"2023-03-07T01:02:08Z","last_seen":"2026-07-26T23:40:36.322592Z","times_seen":71635,"resource_available":true,"data":null}},"time_used":1518,"timings":{"blocked":696,"dns":1,"connect":11,"send":0,"wait":15,"receive":3,"ssl":787},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pro.edgeonetech.workers.dev/?v=https://cdn.midasbuy.com/images/midasLogo.dccd1c37.png","fqdn":"pro.edgeonetech.workers.dev","domain":"edgeonetech.workers.dev","tld":"workers.dev"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgeonetech.workers.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 03:54:13 GMT","end":"Mon, 09 Mar 2026 04:52:54 GMT"},"fingerprint":{"sha1":"F4:B2:62:FB:D2:D4:1E:2A:1E:50:BD:8D:39:B6:F9:40:95:DB:46:12","sha256":"9F:03:DA:8F:5F:BB:ED:ED:4E:60:40:13:20:94:04:33:9F:BB:5F:E6:43:E3:5C:1A:69:94:B7:FB:BD:7F:99:14"}}},"request":{"raw":"GET /?v=https://cdn.midasbuy.com/images/midasLogo.dccd1c37.png HTTP/1.1\r\nHost: pro.edgeonetech.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Bdbg1RS%2BPjOl%2B5jJ9FZCT4lgcQh7Hxfc69izGHQ%2FLpvKGS3dnaGy7Laa7DAO1GbEgcBn1Nxc82FVLGHAxdmIFxLQuqDSVAQSJEbB09XKb%2BWCfK5skk3nCT0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c0e848bc84a5694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/bfea95059a8a754ded3eb4eac49cf727.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.193Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/bfea95059a8a754ded3eb4eac49cf727.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 08:38:18 GMT\r\netag: \"c9c7250875609f2d88e68aed1d119ed3\"\r\ncontent-type: image/png\r\ndate: Fri, 10 Oct 2025 06:22:44 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 10760011618917408615\r\nx-cos-request-id: NjhlOGE2MzRfNTY4ZjdjMWVfMzE5NTVfMWEwOTcxZDY=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NTk0MTE1NTEzNDA\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2658\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 12140377143424299427\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2658,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 96x64, components 3","md5":"c9c7250875609f2d88e68aed1d119ed3","sha1":"40dbdecbbb8792d85aa091c9605b82fe21fe7b94","sha256":"b5356844a20ee1ec27862f19e8cc2e09f383bc41b0a5b27062eb2ea804526ad0","sha512":"e1bad15950620ba34b27a3b1789fee53eca873e0a19ce3e9091d014963943715473aa41dd330b7b93c670204d9ef8bc95859f4d6073fbbbaf4e07f97a40b563c","ssdeep":"","tlshash":"2351191bf0522703fe8ccd7062f1917b6e4955c0b9d2f7a9a1f7e00799604b6c40d2ca","first_seen":"2025-01-22T15:28:39.221024Z","last_seen":"2026-07-19T01:02:47.525155Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1616,"timings":{"blocked":838,"dns":0,"connect":0,"send":0,"wait":778,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/fonts/laza.woff2","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/fonts/laza.woff2 HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 22220\r\ncache-control: public, max-age=604800\r\nexpires: Sun, 25 Jan 2026 17:25:25 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0gcI6biAg8r6HHPRSj7GJF%2FYpYLE1DMnWgJdpptYXTJCQmulvMyvJ6OPquv4yldiKQBNzOf4sI6XqHg9%2FCr7mm4rS4ZbjKm5wyVXl4nug2EW4PLKtbA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e84956b0b8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":22220,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 22220, version 1.0","md5":"345579e8566a3dd6dc9feb5362fbe7e1","sha1":"df075dd0c26e72fd7df19948f07904c1eaa72ded","sha256":"1d0dfcc32b3be2bf3b3dbc371e9b7c5ce205f4bc6f7c8ce0226256cc7064c3e4","sha512":"948b48b697dc39d4c921ef8765053cb414edd47d12c69856191c5e28a580a1ebdb6020d2b8d5639d7ea89fa24fbdd73c16bc5e461b86f644420fffd3fe76b397","ssdeep":"384:1dPjUYc1ZQrSCantuGbZZHmv8m7Uh8OIXXS6pL/AzxeDxw+wBhQPyX/g2g8rYFGk:fJ0qrSCasGZZH9C+lIXppzAz0SLnPgCG","tlshash":"82a2d1a9a2a202d4dafe4405bde8f8b35cc2b43adfc687394a74f54dcc845d18534d5b","first_seen":"2023-05-01T09:29:40Z","last_seen":"2026-07-25T15:40:05.770168Z","times_seen":1015,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/bape1.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/bape1.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 146978\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f6OQ3BQmXGmJWCz3e5%2FvQr3FwN87%2Fg27Bbl2H4cwJK77yG7B4STWJqF%2Fps2MuypWZHHPvgQRUpWecyFHYwe4wTqS1y2AEkjbzS2RD9yb3tho7gQ%2FzFM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b1ca68deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":146978,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"1167af8a54ad30fad8477e6e3ae37f58","sha1":"5bd9d8e70fd02298d23a02ac184762cd85f8a6bc","sha256":"82f9e538a75a608cf7f232113915125ec78d73f53c6ea3d45d7acafe147da2f0","sha512":"5b128be9b3e8c540c37b9dc4cff247fa9705051db2e653c614630399ac0bf44b959b1230a922a7908757a1eff0c55f49a1c3a88ee6ed223eab2b37c2a6ab8665","ssdeep":"3072:zhui36g2FcSKhTLJ7yz1Akdfh06tE23dh7W1JuDo9n8QO1YIwB:zYi3JiW3J7g1AQDEgh6ec8dOIm","tlshash":"c9e3027f88ece0a7f9af807410d79f32ebe3421922e35417e2706d5bd64dc9a9140a76","first_seen":"2026-01-20T12:19:47.971502Z","last_seen":"2026-02-10T22:46:25.391495Z","times_seen":4,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":220,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/639119ab1c94cd1ac8de35c32e3fe1a0.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.184Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/639119ab1c94cd1ac8de35c32e3fe1a0.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"34cf3aa55d10f3f8869f264cdcb2ad5e\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:15:23 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 2435251802681037888\r\nx-cos-request-id: NjZmNDFhZmJfMzU3NmI3MDlfMTRiNzFfN2IzOTk1NA==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc3MDYyODM\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3523\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 17267921914407578141\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3523,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"34cf3aa55d10f3f8869f264cdcb2ad5e","sha1":"94cd8a7d54c36f1ce3f1a5d8925ef4e5c33da7f8","sha256":"6da833d493a4e1a3bf46b9d484477687d4a3c2c92aebf24c82f9e5f128b4368d","sha512":"204744a724e1e64e3c8af81ca50b1efd69a8b0d50f64c6722d71ee8d956a7781b15b9233071e32be8b24267925d5d7e29613e7431480a4e32bc21a7b4c43810e","ssdeep":"","tlshash":"fd715cb2acdb97b2616777a957351c46d7640b0ec9227a191104ee3d483432d28caa0f","first_seen":"2024-10-30T20:47:39.071579Z","last_seen":"2026-07-19T01:02:47.437484Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1638,"timings":{"blocked":851,"dns":0,"connect":0,"send":0,"wait":783,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/0a1b4dfa75b238ba484ddbcd009d0cdb.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.195Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/0a1b4dfa75b238ba484ddbcd009d0cdb.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"25a17b47e2b88c8e7a99224def3543cf\"\r\ncontent-type: image/png\r\ndate: Fri, 10 Oct 2025 03:36:04 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 17448377255871127783\r\nx-cos-request-id: NjhlODdmMjRfZTgwZTc5MWVfMmQ0ZGRfMTlmY2YyZTg=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc5NTg0MTI\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3554\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 11587994779385489745\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3554,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"25a17b47e2b88c8e7a99224def3543cf","sha1":"002fceefa2fb7b4bac37629836f405f3ba721a66","sha256":"be302378bc3a5447e76b46908e654df7a6e0da64b0eecee2279d32cac26322b0","sha512":"491bb066800bd52a14e0d3baacc969a5c6e4881df4bc78c0be2f748d0b97cfedbdf75968a590cdd29acde16160f822c4d4f2cbb9284fc4daaeb49d2a9e846c0b","ssdeep":"","tlshash":"49715ead7b1443d9b557fc6626c4dfc272804f1979305bbec21d86bd7448e296c084d9","first_seen":"2024-10-30T20:47:39.067833Z","last_seen":"2026-07-19T01:02:47.526545Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1906,"timings":{"blocked":840,"dns":0,"connect":0,"send":0,"wait":1065,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/media/open.mp3","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.276Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/media/open.mp3 HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 12675\r\nlast-modified: Sun, 09 Feb 2025 21:30:16 GMT\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\netag: \r\ncontent-range: bytes 0-12674/12675\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P3tVXBGb1B6X3SwkjFzPlU80%2FQQO0yXIPcZpzALrwbti90eukN7ARf97ebTHbKYV%2BJO40JL0OIyhdqio8WWQTI1VgS68EqzwgEGi0A8zwwPI5seuacQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e84933c578deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12675,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo","md5":"58418a30e1310bf4fafa9fa0e57c18d6","sha1":"b477e72668b181c3080d6b921e2edf15ef134f17","sha256":"d5ad34e8bb64fba432c1a12b24cd1e532104d0183045e73abaaec72aa824df1d","sha512":"082eb64f97dd80d382019c11f002badf74c35ba0c27e7d6ddbf04a0ef8f028b005a183224c6481f642f06609b166c1b24dcedb248d5a3f756492a88007c8daa8","ssdeep":"192:NRg5B+tUSp4IpICb0rswRVqb+nmCkyKEM7+sXspvPC9y8ZlgM:cvmmr1+60Ff+uP+M","tlshash":"26428e077f56010ff9e4a73531af2431e9c45e5e28a9cbeb36108bc095af3947b295ca","first_seen":"2023-04-07T19:47:22Z","last_seen":"2026-07-25T23:58:14.660799Z","times_seen":752,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.379Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:07 GMT","end":"Tue, 03 Mar 2026 17:10:06 GMT"},"fingerprint":{"sha1":"82:59:95:33:5E:76:7F:3E:5B:45:F4:CA:83:29:7C:B2:19:B0:A5:C0","sha256":"A1:28:19:D2:C4:EA:69:3E:6D:8D:7A:20:FC:3E:A6:13:BA:59:C5:9C:DE:7D:D1:25:3D:35:68:98:FC:47:82:9D"}}},"request":{"raw":"GET /ajax/libs/jquery/2.1.3/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29707\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:34:39 GMT\r\nexpires: Sun, 17 Jan 2027 18:34:39 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 236663\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":84320,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32180)","md5":"32015dd42e9582a80a84736f5d9a44d7","sha1":"41b4bfbaa96be6d1440db6e78004ade1c134e276","sha256":"8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3","sha512":"eda31b5c7d371d4b3acced51fa92f27a417515317cf437aae09a47c3acc8a36bdbb5a5e70f0fbfd82d3725edf45850dde8ca52c20f9a2d6e038b8eaaceee3cf1","ssdeep":"1536:AP1vk7i6GUHdXXeyQazBu+4HhiO2wd0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrb:z4UdWJiz6UAIJ8pa98Hrb","tlshash":"a283d6d9b2c67062977734b851bf410bb17a98dab80c8c60f0a4d4e47eb4a8d517bf2d","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T16:52:45.073576Z","times_seen":16125,"resource_available":true,"data":null}},"time_used":11,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pro.edgeonetech.workers.dev/?v=https://cdn.midasbuy.com/images/midasLogo.dccd1c37.png","fqdn":"pro.edgeonetech.workers.dev","domain":"edgeonetech.workers.dev","tld":"workers.dev"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.432Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgeonetech.workers.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 03:54:13 GMT","end":"Mon, 09 Mar 2026 04:52:54 GMT"},"fingerprint":{"sha1":"F4:B2:62:FB:D2:D4:1E:2A:1E:50:BD:8D:39:B6:F9:40:95:DB:46:12","sha256":"9F:03:DA:8F:5F:BB:ED:ED:4E:60:40:13:20:94:04:33:9F:BB:5F:E6:43:E3:5C:1A:69:94:B7:FB:BD:7F:99:14"}}},"request":{"raw":"GET /?v=https://cdn.midasbuy.com/images/midasLogo.dccd1c37.png HTTP/1.1\r\nHost: pro.edgeonetech.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jXfvBomMehxUHfvBDvv1CTMDFOF9MbfamODHVjCo50SB%2Fi4d0VIDEaJNkLTAWVUYJpN%2BUj1s8seOXzArGS0%2BCF4pR5Ih7nvJxDwFFwbilCymcF06SaG6WHw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c0e84943f3a7127-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/9fa6d558721f6e36acd07a7e888cb093.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/9fa6d558721f6e36acd07a7e888cb093.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:22 GMT\r\netag: \"f986a3edf3564d07cf8497527a484aca\"\r\ncontent-type: image/png\r\ndate: Mon, 10 Nov 2025 05:42:35 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 7276941598825304217\r\nx-cos-request-id: NjkxMTdiNGJfYmRlZjc4MGJfMjBmMDdfMWU5N2M1Mjk=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc0MDM4MjM\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2237\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 17972009030647302115\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2237,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"f986a3edf3564d07cf8497527a484aca","sha1":"2d993ceef67ea14954dff2f59160e97b83a42899","sha256":"6c84b4807d7c29b131baf7c3f1195711c709971a2f8a528a08d00727d119841f","sha512":"2f21802f114a26d1af0e898432302241bf052005f9d3597d98bc90a9317c358fb7f6ad4c8549073818717752fd276492c8e1168d530e636aa24c00538569dbf0","ssdeep":"","tlshash":"ba41d9ae6716ed56ab0bac71cfc0c430ad9b644910c4664da3e1f479282153ca661d17","first_seen":"2025-01-22T15:28:39.233514Z","last_seen":"2026-07-19T01:02:47.571629Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1656,"timings":{"blocked":641,"dns":0,"connect":7,"send":0,"wait":768,"receive":0,"ssl":239},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/95d5b65e11db4f4b0d51000f44521a95.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/95d5b65e11db4f4b0d51000f44521a95.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"0c51b7e04c9d0676c3456ec6e87f3950\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:15:23 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 1342703616422124124\r\nx-cos-request-id: NjZmNDFhZmJfOTZlZjc4MGJfNDZmXzdkMzhjN2Q=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc1NzAzODQ\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 1608\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 16560094466452772329\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":1608,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"0c51b7e04c9d0676c3456ec6e87f3950","sha1":"62f7700419cd97a5ebab738c9f83a3c2a69960e3","sha256":"77702c068dcd58565b8dda13412ae9af3c51acf066d67511ff533a8efbf0c076","sha512":"dd172ed93a4057b2f965436e5c725e56cc667584c690b5fce5131028fd2e3f3df2129a5b1e8e49803e76bde4d909ab2520152f5bbf1350b0e486826dbde1dd65","ssdeep":"","tlshash":"0c31eae77b80341ca8ee4b80b1b6587072dd553f71a606e4c4812ae90785c35c0ea769","first_seen":"2024-10-30T20:47:38.999188Z","last_seen":"2026-07-19T01:02:47.479414Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1588,"timings":{"blocked":823,"dns":0,"connect":0,"send":0,"wait":765,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.midasbuy.com/oversea_web/static/images/big-new-close-icon.png","fqdn":"cdn.midasbuy.com","domain":"midasbuy.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.midasbuy.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Thu, 17 Apr 2025 00:00:00 GMT","end":"Mon, 18 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"36:C0:42:2D:03:4F:38:58:E6:A1:2A:40:FF:E0:C8:99:CA:D5:21:99","sha256":"30:85:DB:98:42:24:54:F2:64:05:32:EB:ED:AD:83:0D:25:C2:2C:34:27:EF:72:1D:D1:BB:C6:C7:B0:BE:EC:36"}}},"request":{"raw":"GET /oversea_web/static/images/big-new-close-icon.png HTTP/1.1\r\nHost: cdn.midasbuy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ncontent-length: 0\r\nx-nws-log-uuid: 8142014691837373329\r\nserver: Lego Server\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\nx-cache-lookup: Return Directly\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/2061.c1b1bdd3.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.926Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/2061.c1b1bdd3.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 89264\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:09 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BIp2hFXHzN17dlWNRDuyoro9X1oIA0zwqb%2BZcCUa6P0C1xudeTXataLZam%2BoDqsLJDvPRJPIu%2Fqr49QRQjSXpdBd%2FCeq5rTTSYP8jzczBGlDXjHtZ9U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a4a8d8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":779340,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"4b6185e0b8a63eddf22622f29165896b","sha1":"68c0fa76f95bcbd6ced198b00c10e43696bcc9a6","sha256":"412879b45d1328b52c057682e588d3b71298ccaac80f550dfb82fe87a7244502","sha512":"9b2b70460b3db19a18bb8e547cb8ec99f75e1369a3538997e5b5160833d9a44510be0a6e776382f0197f29fa27675f5f1a9403fdaf8ac9d8e2bf441866093954","ssdeep":"6144:zenYXN+gDB7FzXpVFYguC2S2Q2JcsEuqrmX/qr0Lqr0BkVwJUGa+86kAq:zeniNFLpVFJ2Slpuqr4/qr0Lqr0IEkAq","tlshash":"28f473f1e401098626bb3f59d7d645a8eb8066d3ca436979bacc851edff09ea3140f4c","first_seen":"2026-01-03T19:33:29.740385Z","last_seen":"2026-02-18T03:17:18.067902Z","times_seen":8,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/oNadMsn.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.090Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /oNadMsn.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Wed, 26 Nov 2025 16:01:32 GMT\r\netag: \"367147d4a3376943bb12f1a7c747a60c\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: DAYrjdYBeHbyAh-NCAzSCBiTl5Yyl7HtVNwa8GLLkjV6IDcwvD-3jg==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 1121143\r\nx-served-by: cache-iad-kcgs7200167-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 7, 260\r\nx-timer: S1768911541.114436,VS0,VE1\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 2677\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2677,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 48, 8-bit/color RGB, non-interlaced","md5":"367147d4a3376943bb12f1a7c747a60c","sha1":"06c54429a25c1bf8255c42d1b0f97a1a9cd111b7","sha256":"b2f72bcedc8619283c3f7d72d4976f29586836eaf2e533b0c6d7a01855c1ba7c","sha512":"6caebbe8847d82c3069d6e25f59b5ec1996a4446cb164311f7abbde234be5524ac5aa2633c627a09b82e3d8edccaa33f656d87e3e4350f116c5d8db08367af74","ssdeep":"","tlshash":"78511c624b5af558f2576035c094183759fac5721b20a780e64b1e2d627d70aee2d18e","first_seen":"2025-12-13T04:44:10.92757Z","last_seen":"2026-05-02T14:51:08.471246Z","times_seen":16,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":19,"dns":0,"connect":0,"send":0,"wait":18,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/2a34d021fa8905bfbee4b949d9112955.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.200Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/2a34d021fa8905bfbee4b949d9112955.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 08:38:18 GMT\r\netag: \"b1ef3a4c526fab33ff2d61e70691b5c3\"\r\ncontent-type: image/png\r\ndate: Wed, 17 Sep 2025 05:33:40 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 1838305195991445584\r\nx-cos-request-id: NjhjYTQ4MzRfY2RkMTE3MWRfMmZjMjFfMTY5YzgwMGU=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NTk0MTEyNDA2OTg\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3160\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 16389732759468402369\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3160,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 96x64, components 3","md5":"b1ef3a4c526fab33ff2d61e70691b5c3","sha1":"8c45f00e9ebd183e98e4aba34afb9fbac36fc5fb","sha256":"9b317e8849ef1840d10379afa7a9541a6aafaa6ad1f3d97e97051ed0ae59cadb","sha512":"c2199fba35c8f7746eca59e6fda0a705ca37966ea8faa25e34aaf697833fd4a115fb021e91a1cd1fcbe325b92cceaffd2b4f5d43f32f2ccb0f71db7cfc793661","ssdeep":"","tlshash":"7a51f94bf9625b03d600d27624f786375b6852c0ed63e06cb4bdd81beca10f99a627d1","first_seen":"2025-01-22T15:28:39.172827Z","last_seen":"2026-07-19T01:02:47.579567Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1622,"timings":{"blocked":832,"dns":0,"connect":0,"send":0,"wait":788,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/a6261977ff0293e3058964c7a2afe32a.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.201Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/a6261977ff0293e3058964c7a2afe32a.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:22 GMT\r\netag: \"b31ce4ea3f36b643d879bc775e4b2230\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 15:27:03 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 15071490587419365839\r\nx-cos-request-id: NjZmNDJiYzdfNGJhZjRkMGJfMTYyYWJfN2MyOWQzYQ==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc0NTYzMzA\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2374\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 10710794555108834734\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2374,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"b31ce4ea3f36b643d879bc775e4b2230","sha1":"95e1148688e09900f7754747a1e5d0c8e8b6ff08","sha256":"7a5bbae00b4f97b85816835eb0df867db461915f68a1c9bf5db39bbc40b6e11d","sha512":"431738a269c471e9c557893a9e9ccceda588218201b71a71171f2f6ebb4346595ef1cac68bc0ad67c661f22c24a4ed66f8aef974141482100472724e252d9b15","ssdeep":"","tlshash":"f5413b198bd4c75e4ad505302b1bf38d62c9786cb1484f245180f84d2eace031362db9","first_seen":"2025-01-22T15:28:39.226755Z","last_seen":"2026-07-19T01:02:47.44208Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1871,"timings":{"blocked":831,"dns":0,"connect":0,"send":0,"wait":1040,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/public/c92763068a5478ebdc393cd4f562e8a0.jpg","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.410Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /public/c92763068a5478ebdc393cd4f562e8a0.jpg HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Sat, 07 Oct 2023 08:18:41 GMT\r\netag: \"b1ef3a4c526fab33ff2d61e70691b5c3\"\r\ncontent-type: image/jpeg\r\ndate: Tue, 20 Aug 2024 09:12:47 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 1838305195991445584\r\nx-cos-request-id: NjZjNDVlMGZfZDllZjc4MGJfMjE2ZDhfMzcwODcxMQ==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNDc0MDY5ODc2MzM5OTk\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3160\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 13132089989267329732\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3160,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 96x64, components 3","md5":"b1ef3a4c526fab33ff2d61e70691b5c3","sha1":"8c45f00e9ebd183e98e4aba34afb9fbac36fc5fb","sha256":"9b317e8849ef1840d10379afa7a9541a6aafaa6ad1f3d97e97051ed0ae59cadb","sha512":"c2199fba35c8f7746eca59e6fda0a705ca37966ea8faa25e34aaf697833fd4a115fb021e91a1cd1fcbe325b92cceaffd2b4f5d43f32f2ccb0f71db7cfc793661","ssdeep":"","tlshash":"7a51f94bf9625b03d600d27624f786375b6852c0ed63e06cb4bdd81beca10f99a627d1","first_seen":"2025-01-22T15:28:39.172827Z","last_seen":"2026-07-19T01:02:47.579567Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1716,"timings":{"blocked":624,"dns":0,"connect":0,"send":0,"wait":1091,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pro.edgeonetech.workers.dev/?v=https://cdn.midasbuy.com/images/1.7de7e446.png","fqdn":"pro.edgeonetech.workers.dev","domain":"edgeonetech.workers.dev","tld":"workers.dev"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.565Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgeonetech.workers.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 03:54:13 GMT","end":"Mon, 09 Mar 2026 04:52:54 GMT"},"fingerprint":{"sha1":"F4:B2:62:FB:D2:D4:1E:2A:1E:50:BD:8D:39:B6:F9:40:95:DB:46:12","sha256":"9F:03:DA:8F:5F:BB:ED:ED:4E:60:40:13:20:94:04:33:9F:BB:5F:E6:43:E3:5C:1A:69:94:B7:FB:BD:7F:99:14"}}},"request":{"raw":"GET /?v=https://cdn.midasbuy.com/images/1.7de7e446.png HTTP/1.1\r\nHost: pro.edgeonetech.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YvYDs%2F2J6u9HjGnRlGAcVd5YGT5VJNErvikk2gNDgF6QHVY1Fwze0BKaaP9HRukUxRQ%2F95rESFIcdrsS7CDA7qSOJcseHmyB2WVc5C3lSiiEL8RHHydHy%2FU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c0e8494ffe37127-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/3200.a40b11db.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/3200.a40b11db.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 3932\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:09 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SMc7bVaXstJc22vaVNNt%2FHkp%2F8v%2F%2FAQSoemVFyakFo1PeOsB7g4mINNMvqWPAZvCGA8M8WHpbwo9e05oJelmtrAuPAfPa8r7M9ksPdWY1JQ1fz2%2FROY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a3a448deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23133,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (2241), with CRLF line terminators","md5":"98c2e0cd343ec4d5b6cc54e4039bfa9a","sha1":"012d68a28af58f6a0424dde384ed1f6f57a11d08","sha256":"417a6a78e234d2e24822aa4d363d6283df3007242977b85e0fa6efb32eda6ac9","sha512":"b5fc762948f5e770c30aae2c40c1d7d304983033ada8c7077e70192ae890079025a01b7d97a4537be51351ab66dd9a4d0fc4dea5cc9fb5f9f33a4f017f1cd385","ssdeep":"192:tmUJbiKneW1kU7TkUd8nvshzRz4eVEKiJT4Y7b7UWzaMGAgXc/A2BK1OSjOSv8l5:4UbegVlzUn2YBQ9EB","tlshash":"91a2fd6052512082463bcf6acba94634e86209e35643ac7575c05a84eff2dfcf38ed7d","first_seen":"2026-01-03T19:33:29.804676Z","last_seen":"2026-07-23T22:44:16.920748Z","times_seen":10,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/2291.ce051814.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/2291.ce051814.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 94474\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:12 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cOr4i4Aw%2Ba24N%2FYLqxcDjijYJ1k1%2B%2F5ZQCr377Wi6m2YP%2BU7ZvIMaWZd3Ni2BwNBQ2CQ00v42NMQkodYlBSmc5Nzd8rVZOEGkMjM7qWzT5jPQSuZGb8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a6ad58deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":678070,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"0423710209633d991d2687be6177d62f","sha1":"a9a6b7b2f22c37306cdc7d5e4152383f953e6051","sha256":"361a4079b1dce46c0f82cb6143b29f20057beefac3156cb94f567d8ae9096734","sha512":"d80dc8b2d553f5b2a96dc26f4253303125cc8fb86d750139a60ed3d8aa1f310d9abf7649e03bc1601125ef78899a6672d58af46f8b0172c7a970d101d42c0b1a","ssdeep":"6144:RSgXcU7nZZfChqBFQrC/eXINb83O0Y0nR:RSWcUKhqBFQ+/eXINb83O0rnR","tlshash":"74e45075a86119b93973afe1dbe7021eea22049ba3030c647dec691f0f701e49859fdd","first_seen":"2026-01-03T19:33:29.761866Z","last_seen":"2026-02-18T03:17:18.024728Z","times_seen":8,"resource_available":false,"data":null}},"time_used":365,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":161,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/10.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.171Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/10.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 72075\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P5GUGb9PFPNe7uqYThLIwLkvgI1FgEFhgT87jKlVfvsGMT0VL7oucenXokSffoEW%2F8WKkiZXE4oDwtcp1qu%2FNMkPIxv1pI%2FoJ5AU37A0GY%2FCm0LK8Ac%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b4d4f8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":72075,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 350 x 350, 8-bit/color RGBA, non-interlaced","md5":"e244a9bb8b648cf5a5d2f8346e243e0a","sha1":"653bed0febe127c335b1f201594efb2ce5250e4a","sha256":"a7ca750c7026aaf8b706c9b72446899edf7d95de0da1288de4aed064660ac0ce","sha512":"3ea990db4c061514a36529b19eaed3c883c0c3bd570fcf741ed8d287ee38daf50ba4c13e17b4fff12b51c01f3e97ba8fc8a5c6e533c7922bbd5810d588152e2d","ssdeep":"1536:99i2wdf7oCNwCv8rqcaddr76Ai8fe/4AkfcLDMQEhtkXmic0W+B3P:DMdfsmwCv8yddP6Ai8fObkfc8QGk2iBf","tlshash":"cc63022ac43f3ae171b31dac1fc820a78e579de8767c0a7bc957950e99b705f4822817","first_seen":"2026-01-20T12:19:47.988191Z","last_seen":"2026-02-10T22:46:25.390622Z","times_seen":4,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/7bc1bd1d7d6bb6740dab72c08f5a65de.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.203Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/7bc1bd1d7d6bb6740dab72c08f5a65de.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:22 GMT\r\netag: \"8a4a36ced8460cff6621203b4a8be599\"\r\ncontent-type: image/png\r\ndate: Fri, 25 Jul 2025 03:14:18 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 5559300856640754477\r\nx-cos-request-id: Njg4MmY2OGFfZjgxNTc5MWVfMjYwNDNfZWQzZjVjNA==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc0OTYwNjA\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2399\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 9065897324098107273\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2399,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"8a4a36ced8460cff6621203b4a8be599","sha1":"345dbccbe726602e863c86c9b10cc9a7b46b2152","sha256":"fa7f1acab16c0bf21fdb72566f0d86176c59d2489d16891ad31a4abb15e1a616","sha512":"fa69a21063d5d034c0b839b853d3c57ae7a7959034003a9b77230ff0c9103cf6aad22dc5d344cb118096e4593985d29e001ff8a6c76561c3ae750eb60e469863","ssdeep":"","tlshash":"5a410ab51ba4e4d9b66aedb0727437641b7e0a36c884df085af983043b3d9940f85164","first_seen":"2024-10-30T20:47:38.972314Z","last_seen":"2026-07-19T01:02:47.568041Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1618,"timings":{"blocked":832,"dns":0,"connect":0,"send":0,"wait":782,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/bc39cd5cf4e6cd018cd48fb70ad91d2c.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.324Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/bc39cd5cf4e6cd018cd48fb70ad91d2c.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"4a6a3b7d9837b8f7207a3c41151338f7\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:36:36 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 14809323883257438907\r\nx-cos-request-id: NjZmNDFmZjRfZGVlZjc4MGJfMjJlMDJfN2JlZmY4MA==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc4ODQ2ODg\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2784\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 4553662637068985194\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2784,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"4a6a3b7d9837b8f7207a3c41151338f7","sha1":"a4aab93f9794a5e361beca68c9d5d734d011c989","sha256":"45b2dc66f7911350083ecdc7a31798f7b1d34e997da51001f514918254fdb9f0","sha512":"a3a1d60d15d1d5a8d4ee1936ec4b73684015bfe2f06096fa466dc26d4cd0278484c7f776f0c0278754e64ca1b3d97a3b1a152c250d2b69acc7636100ef656ede","ssdeep":"","tlshash":"71515c1d1471807dfae6dce70a2c7b7038e01e01469fc47432559ca9a7a308c2856e8f","first_seen":"2025-01-22T15:28:39.169687Z","last_seen":"2026-07-19T01:02:47.444307Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1502,"timings":{"blocked":708,"dns":0,"connect":0,"send":0,"wait":794,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/kecap-notif.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.561Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/kecap-notif.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 25253\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Zvhub6Bo8o%2Bgz1Qz9E3l5AA2WH1Zx33hJP4r2LsPqDSfYKEwIpQEeCRnseLG7%2FS%2FO9WfDDaerRtHieoynAjx8veE3boeR21iqLY2oMO6PygABhfHThQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e8494f9de8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25253,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 207, 8-bit colormap, non-interlaced","md5":"33356e0bb6de420a6255f2e5dc910ddb","sha1":"614ae308e00075c32fb3d3ada9a1ceb15265e3fd","sha256":"ca7c6046ec386a42651165ece409ac33fd7e736490fba4146e0cf07f1ce30bc0","sha512":"d22188f8188f8afbbe155f92cb24f8746be9ca32f0659e7c7a2925db3d66793bb5c81aee31ff5c59ce644a66f705009f13352adf9f3a952259e58b87e258048c","ssdeep":"384:DdBzpqn04oHzPSPXZkdcomwNdLAPGShTeP7TK5cWm62i9dj6a81mV3ctL:RBe0xHzWkdnmWyHpED6L9djDcN","tlshash":"a6b2f176efe8714a6249e5d893d5e211c0e7021b0df28428ed6d654437af2167cb7d4c","first_seen":"2024-03-01T05:20:04Z","last_seen":"2026-02-10T22:46:25.42747Z","times_seen":11,"resource_available":false,"data":null}},"time_used":223,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":222,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/7652.aef5054d.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/7652.aef5054d.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 11233\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:11 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QfOWhBoBPREYErWo%2BRy4DuJt9bwVhYJTi17ZQyXw0DeDc6bmTr0OGw2sQrRfwh%2BKwn%2FXHNFWQaPdB3cWcEL%2Fa7g4uSKAKOXnrN%2BwmMsai%2BKkl%2F1rCqo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a4a918deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":88197,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (4040), with CRLF line terminators","md5":"aac862ca69eaca978c249037a83e8c0e","sha1":"b572a1790466b24ecae490238201fd6001041ceb","sha256":"9cc96c5c6ff33c55e09282e69cc93ac3c4efb49f33e901ab7b495abe106e367f","sha512":"501faa397ee0dece892c6ec4dfe61411a83e7ef2796d2edb5bf2638a4b20a25a8768e4d42ffd2a40caf4039e16dbe25a33e4167b7256f6a76ddbeeb4be2d7110","ssdeep":"768:Vi9qUt0PKByLP2dbui9qXva+NRRJNJTQi9qG:ViQUt0SBQ2dbuiQqiQG","tlshash":"65837464a4220e4dabbb6f64f7b7123df78094236947552c7dccaa094fb05b87061f8e","first_seen":"2026-01-03T19:33:29.791192Z","last_seen":"2026-07-23T22:44:16.911111Z","times_seen":10,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/bape3.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/bape3.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 85987\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 23 Jan 2026 13:34:06 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=P70H1QvbH6eZfc%2FC%2BKxqxuJDIb3EEXEfr92wUBN3kRorbB7QQKj1tQPwOzYwQO7scl6639dbKHt%2Fll%2FsvObcT8xQfPZst7U1cLoBF3NvwLNfdAzYksI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b1cad8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":85987,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"4349608d299aedb4b1c8a4c109bbce1a","sha1":"b3be3f1c78e2b3021d589c98275c7400943cd17a","sha256":"c9bee9eb7af4c6e4ee34848757ae57d39bb9b23dba2fcd5e4d01423d85054a06","sha512":"0d5718380825831d625b88c3302749fa3c328e3b1f1116b59f3800d1b5fdebe7e1dd5a353e13f66e5231de648be7c5bf736eaf38a5d7a1751a61dd9d0e665bb8","ssdeep":"1536:SLb9kXFv8+q6pgpGD3iB5Exv7YW2uRjZPrO/OkfeL6zUyp7jjjWdZMyh:8bYv8PAgIM5ExvUWNjZPrO/OBL6FjWZh","tlshash":"5683012e76b4e885cdcbc8f54680afa7502fe9ad2dfc54bcf90b282d919cc256645d00","first_seen":"2026-01-20T12:19:47.99749Z","last_seen":"2026-02-10T22:46:25.422859Z","times_seen":4,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/516a0baffe3a159e68bdd86de0b44370.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.183Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/516a0baffe3a159e68bdd86de0b44370.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 08:38:18 GMT\r\netag: \"a5ff17926f949e590b114f0a682371dc\"\r\ncontent-type: image/png\r\ndate: Mon, 20 Nov 2023 15:03:02 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 13043999600941662932\r\nx-cos-request-id: NjU1Yjc1MjZfMzJlYzE1MGJfNmQ4Y19iMjQwMmQy\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NTk0MTEzNzkzNDI\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3118\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 11930893257225931817\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3118,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 96x64, components 3","md5":"a5ff17926f949e590b114f0a682371dc","sha1":"92af0e023bc64f989f73a126da0a42c84ef69ef8","sha256":"e8b5f812cf186241355e731c5d28464b3e9c238fa48b01be7e6959270b921cbe","sha512":"bed4104319e1c99823d3e548caa14cae17a303a827ab25b3d5084f9aa9b5ab234d2069331c2bf812ee62d7607f51f7f3e9bacec3f208d05a54d8acdbf58b7d15","ssdeep":"","tlshash":"8b51090cb650a742dd4fd97431f2c7324ba070a5bcd0e954a9bd8c4fadb51f04a2a69b","first_seen":"2024-10-30T20:47:38.976818Z","last_seen":"2026-07-19T01:02:47.470722Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1641,"timings":{"blocked":852,"dns":0,"connect":0,"send":0,"wait":788,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/cdn-cgi/challenge-platform/scripts/jsd/main.js","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 302 Found\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-length: 0\r\ncf-ray: 9c0e8497694a8deb-OSL\r\nlocation: /cdn-cgi/challenge-platform/h/b/scripts/jsd/d251aa49a8a3/main.js?\r\ncache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public\r\naccess-control-allow-origin: *\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=0r1DEtjFFcbM5nXrvWm7uuQvWF7fwOifRy5fk0mi7jR2hhmO%2FDigEdkeQR8PmR%2F%2F4KYp4%2BXALNJAEDKdna1rUlLjYNmfwGdnl7LM9YcXpNmsxrLTTQNSHceNCk2cE9%2BP6xPHiAqF3gcE\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nvary: Accept-Encoding\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=QUIC\u0026rtt=3690\u0026min_rtt=817\u0026rtt_var=3752\u0026sent=2328\u0026recv=120\u0026lost=0\u0026retrans=0\u0026sent_bytes=2604130\u0026recv_bytes=26040\u0026delivery_rate=23354239\u0026cwnd=800700\u0026unsent_bytes=0\u0026cid=325bd89cd8e58b8b\u0026ts=2266\u0026x=1\", cfExtPri, cfHdrFlush;dur=0\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19174,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/flaglink.js","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/flaglink.js HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 40716\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\netag: \r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4qWm%2BDKGbdexG3CSvAmsv%2BeojSe1YufeQjUk75pSxBK5ZxoH9QLZhZjN%2FLCnfd562FVlCZwPLZW3Sys47OXmAZbSKS8l6KR8%2FFjUxklMwhVHZuuSfxM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848aab928deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":320021,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1625), with CRLF line terminators","md5":"a3de47d0c5149149bebc1ed56b6f7188","sha1":"43cdb6fc2a89067836557854b75cfa7f313437c0","sha256":"0348365d4d16c36ac5a1f83f46603b4266fa18902aa1b70c4ba6d5a1ec74e7da","sha512":"68b5ece26e190331743a22f2756f0806e16b8f35fc87e0e330c2d9e6589868be0e3d2dc37175c9aec38f6a02b0eb44532f5963897d46fac6ebdc9619788c1ef7","ssdeep":"3072:Pabuvjtl8VAqI7H+bGwbGKGQjNBmnnYdvw:P37/LebGwbGCi","tlshash":"f364f062d636a717b371b56c42a37dc9d98c6adbc0884cca39fe9b8d0f3d4b2459c118","first_seen":"2025-01-22T15:28:39.269469Z","last_seen":"2026-05-13T13:04:07.265521Z","times_seen":12,"resource_available":true,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":202,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/4.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/4.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 72314\r\ncache-control: public, max-age=604800\r\nexpires: Fri, 23 Jan 2026 13:34:06 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=noO7okYBC%2FsScalJx4MWxG7jyD%2Fy4jl9yYCT%2FvjW1MZzNt%2BT7bkzkzEdKoxG4twosdDNaM0NIjy5VDBA1KAL4jmJ5S%2BhtLpmJ7RDb9pV%2BXZcXLt%2BK5s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b4d428deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":72314,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 350 x 350, 8-bit/color RGBA, non-interlaced","md5":"a3c3b4fe96f0dfbd0dba6bdab19fb05a","sha1":"317ce96b30681d5643c44a361a66baf2b7ee00cf","sha256":"0705a5bac411db1d4e34c54852d398ac96029ad05fd171d90e2015a0f2df15d6","sha512":"947fbdafeebea3b8d15c8f6669f1d500d0a22e4bf138e6554bbc79ebe29e35cf263c20aef6ad2d10014b406410435aa2b7841cfd3bdceee1641713a69ccf8379","ssdeep":"1536:10f2NtQmusC1G7+fZdLC74btVgBykPmTHQP1kAgviak:62vjum4ZdQeY90U1kA4k","tlshash":"c9630293227d912eabe664bc1f7c4e62af44e041facc924dcc7ce7b91d61150e9c066e","first_seen":"2025-07-08T02:56:52.738582Z","last_seen":"2026-06-12T01:02:04.517722Z","times_seen":16,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/9.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/9.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 107386\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WFp%2Fxr4gf4%2FQWQqxVauDE0I2baspJT1oBE40rhURHG6ztQ1prooFVwnXWEDV1wZkfauupjvTZ%2Fq299HPogG8Hq3W9fUvyNuVxXgjdtJ%2BQgWio8Dsyxc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b4d4d8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":107386,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 350 x 350, 8-bit/color RGBA, non-interlaced","md5":"6605d9411cfe831bd88939e291d35c95","sha1":"6fb9163818e8c0ad6c6a506122f220ecf3957270","sha256":"1c83dc6101041f4bf73344d58331cae149e099b6dd9cd9ecba5a9069b1fde824","sha512":"5ed3a9b128569aa08d035fc7ae939059899331894863b5fad880b78cdcae0fd85fa0316333bfc3a30c3c6f8ef0c2042f99c5a8edfd14ec959812e25c0bc76d5c","ssdeep":"3072:67Ht7NwzrwyjU6sq/+2bKfRK9isBV7j8aC9fjBa:67Ht7WYtqxKfR0fqfjBa","tlshash":"8aa3027ea1fd24e9e3771c3f0ee0b19e0db9a9978afcb94c7a34e55204b090d4981b11","first_seen":"2026-01-20T12:19:48.004749Z","last_seen":"2026-02-10T22:46:25.43837Z","times_seen":4,"resource_available":false,"data":null}},"time_used":220,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/ea5a6d6957c40eba3e23ab595a21149f.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.188Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/ea5a6d6957c40eba3e23ab595a21149f.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"d244ed5276d11a8cda6da856db0ea9ec\"\r\ncontent-type: image/png\r\ndate: Fri, 10 Oct 2025 03:54:50 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 13077386745630545903\r\nx-cos-request-id: NjhlODgzOGFfN2FmNGQwYl84YmRfMTljNjljYzg=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDgxNzg4NTc\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 4475\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 15152522641844774655\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":4475,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"d244ed5276d11a8cda6da856db0ea9ec","sha1":"8e8dc2f5f2388de5bd7e38972dfcce8ce871cdcb","sha256":"e79a60b11e79667b7d66c3b748e100ee3f03f9fb834335896ddaa709acf95c0d","sha512":"cf8720e0983e663866607b0e41c457f425db18714d8cb78a3fe9ab7c85b28a85a3740ff06c9a27ea74b7a8195ab2189e1751b7df0d26f93a5b4aa8633425801f","ssdeep":"96:d65sWsLEEF3ehQM9xSMqtbGUR6NjRZSGR2FbyYyn64wFtT5H5sWsSk:d6kF3Af/QijOSmyT64q5HU","tlshash":"67916c389ee54620e67e217618a5dc90942aa4831b9388b7d3a7f08307545d73ffb27f","first_seen":"2024-10-30T20:47:39.049799Z","last_seen":"2026-07-19T01:02:47.566865Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1643,"timings":{"blocked":843,"dns":0,"connect":0,"send":0,"wait":799,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/c6694223f15f72bc9598ac3162376fb5.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/c6694223f15f72bc9598ac3162376fb5.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"5d49765c2a76884ccb2fe5bf478dee9b\"\r\ncontent-type: image/png\r\ndate: Wed, 02 Apr 2025 12:44:49 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 8814007657777746047\r\nx-cos-request-id: NjdlZDMxNDFfODY3NWI3MDlfYzkwNl9kMWYwZTc5\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDgwMDgxODQ\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3717\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 12752223580142441739\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3717,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"5d49765c2a76884ccb2fe5bf478dee9b","sha1":"5319ba1426411a80fdd3e63a682fcb97e12d6ec4","sha256":"3dea9a73cd732f132543ac86091bd8f81bdbf4a96eb394e0e2018d9600305a05","sha512":"6fbfb3e8f8b7e5ceb84cae02203fb4f6d35f5fddbdcf7124296d56373892580b1dffde03757f302ca3bc48e3949687a3f3b3358c7dd9cc7eddf490a901fcfd34","ssdeep":"","tlshash":"d4718e25a5c0d564e0b4dc2c3c94e36bfd6430d53331ba214b0816f8283588772d7762","first_seen":"2024-10-30T20:47:39.053962Z","last_seen":"2026-07-19T01:02:47.501145Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1620,"timings":{"blocked":833,"dns":0,"connect":0,"send":0,"wait":783,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/41b77362b3230cc91ee4e0488822b329.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.326Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/41b77362b3230cc91ee4e0488822b329.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"81ede4eb8eb2b3db641f1cbd2f60a87f\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:21:20 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 4926685711299190850\r\nx-cos-request-id: NjZmNDFjNjBfMjZiMjRkMGJfMWNjZTFfN2MzZmJkNA==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDgyMDMyNTg\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3278\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 1004475227428470926\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3278,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"81ede4eb8eb2b3db641f1cbd2f60a87f","sha1":"220bc6235c5c923cd4f1c870331ea28e82766ee0","sha256":"58718916319e2074574e584d9e0053fb19b62f7571ca2b91d4151c124074b34e","sha512":"73b4b102a75e4ad00735ce4440d0678091dc419eb37d82cd9958a83a5a6ac4bb28c8da4861e90d3795b1f65f37f6adcabbdfd3af4d93645004ecbaa37ddb9fd3","ssdeep":"","tlshash":"9b612cf9154ed33b2daf9e30513d31b3b65152b8954f544e2a8c438255b081e9cd8058","first_seen":"2024-10-30T20:47:39.057375Z","last_seen":"2026-07-19T01:02:47.460425Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1498,"timings":{"blocked":706,"dns":0,"connect":0,"send":0,"wait":789,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/find/2.4d71ee03.jpg","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.542Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/find/2.4d71ee03.jpg HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 200126\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sp5zmhwiy%2FgTQk5Iwud6iYrDYUv2XHGIdl2VbGlVe3L97vRephr1jx7MI316Sgetis0Fzl1iDkqFIFVoBVK4N4SGKMxmlGR86hwcz%2BSXAlkdRdLH%2F%2Fw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c2fcd8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":200126,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2460x1080, components 3","md5":"4d71ee03b0f0bee2365c91b54956c404","sha1":"89aace8dfc7a3c29c852b081625380c305d2f5a2","sha256":"8dd984223922810afa892b8d60539352f4e30ea19c1826f46529dbbb3f42d898","sha512":"f7255d8b805069ae829b985ffe6cf3c135a688de7b27e778c02c9af2c26a77f75612cee950f15806f60ccfdd1aa3bc7457f62cc260a69208455c9ea66c7ddd95","ssdeep":"3072:9Z0h08Unwyn/2zEmk91N5jE+ytPNlT8j8VZoh3kcw7RT03gZ1vTvsbXvgv8NCY:9ZGUwkzR9fq3tPwj4ZEGU87sDg4CY","tlshash":"ab1412a5090626d7c9ffa3300296db7d2a0b85fcc5598b61e2b44f71e8e26f2bc34516","first_seen":"2025-01-22T15:28:39.132159Z","last_seen":"2026-07-23T22:44:16.925234Z","times_seen":28,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":202,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/824.df542587.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.910Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/824.df542587.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 19961\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:10 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NCGjESDmiJfnTSy2FhvG40guIW0EEK6ulA7Ya71YdeXpTxCArnmuQsKcC8zJj2h%2F%2B3pzua8liZtexsXGs3rimZlTUAUlO6eJYivKH%2Fg2WbF%2Bvwj2PNw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a3a538deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":210019,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"94d2cd7832bea965c02f4845ebf85d75","sha1":"621a4eaefc930d0931ce58b7b3a3630797d863b9","sha256":"a8f7a86e4913d8c71792b9be132f5f809ddb5212d65916b1f4de47a27c6f999a","sha512":"dc5629b37016a2f895e8034712f18717e2e3848391bf423c219e98fac9204e9b3d6cc1d0279ee0763af49576dd9e7f0e8dd5bbff35df5c31d2ee39b94ff2f15d","ssdeep":"3072:3VJARDSH6HzfbzdswIO5F6IB7yacP2o2Dc+pteqI/GvkzUjDFQ/tVGVuVNUr7Vll:lrwYCll","tlshash":"2d2462a290420ad37672bf7aafd68dc6db2119d39a021c7875cdd2164ff05bce258e4c","first_seen":"2026-01-03T19:33:29.707953Z","last_seen":"2026-02-18T03:17:18.067243Z","times_seen":8,"resource_available":false,"data":null}},"time_used":223,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/e244669a6fa4cfe89aed057519161d78.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.191Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/e244669a6fa4cfe89aed057519161d78.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:22 GMT\r\netag: \"e08a15423337ba937e065eda36347810\"\r\ncontent-type: image/png\r\ndate: Fri, 10 Oct 2025 06:22:44 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 7780438810268737174\r\nx-cos-request-id: NjhlOGE2MzRfN2Q4YzdjMWVfZWMxM18xOWQ4YWJiYw==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDczMTM1ODg\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3667\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 417797460362216104\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3667,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"e08a15423337ba937e065eda36347810","sha1":"2e5418097de8a02d22fccbc41ecafb78b3c689ed","sha256":"75cb45b3932dbc949430927b52c905d741b2418470c74a7a8dbf0e8883457511","sha512":"2981bdb016f2531033ae9cd76f5ca446fe85d15f915cb098e1f99279cbdf2096b53af77b69620519c194307db0b97c5a88c8d8fc98b90183018829a5e8506f95","ssdeep":"","tlshash":"80716d741d5cd9be402d1ce5d391a57cd6d0364c4fad0f0e9a43670d33aab4cf952694","first_seen":"2025-01-22T15:28:39.168405Z","last_seen":"2026-07-19T01:02:47.461689Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1666,"timings":{"blocked":840,"dns":0,"connect":0,"send":0,"wait":826,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/9862aeaf448f32090a4c61dced07ae74.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/9862aeaf448f32090a4c61dced07ae74.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Tue, 11 Jul 2023 12:09:00 GMT\r\netag: \"525e2453f58f8f8a52d4d226557f7947\"\r\ncontent-type: image/png\r\ndate: Fri, 25 Jul 2025 03:13:26 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 13514664086594741981\r\nx-cos-request-id: Njg4MmY2NTZfNGYxNTc5MWVfYjM1M19lZDg1MWQy\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTQ5OTYzNjk0MTUzMzg\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 8273\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 18175832827555556428\r\nx-cache-lookup: Cache Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":8273,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"525e2453f58f8f8a52d4d226557f7947","sha1":"fb295832a2d81edd5c7cc16e946d3728eb1795ce","sha256":"4b6e1dc3fe4ab6e3017023bcfc253977a3c1924c84ac1cf0dfc125d8c3c2d2be","sha512":"88ec057f1c0ede6380c96c852067997059a81ddd73cf307d32cbe0e3d27a0b2339052e455762ef48da0998ffda2eda25ac8f4bae0e8500057b6baaaeb8e5bb76","ssdeep":"96:T6Zb9cKbr0s2O2A2J+aN+ZlTErMrkyo7m0C9enWRM+70QeKmv8rZylSvXd7/NiMS:ub9c7O2AiN+Zl1UM2+70QeVJYlxD9Rk1","tlshash":"fa02ae579cfaede1cad4b5e354508acc8a762544a98e3b3380811e0c8b67e329875b4a","first_seen":"2023-05-01T11:58:24Z","last_seen":"2026-07-19T01:02:47.527434Z","times_seen":64,"resource_available":false,"data":null}},"time_used":855,"timings":{"blocked":831,"dns":0,"connect":0,"send":0,"wait":22,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/style-img/google.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/style-img/google.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 70339\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mRu50Rmm7DeqrY%2FRK6rYvBuaj2Vfk7LU4F8%2FvCBo35lNlfIQMeV17SBNQqwy4wsVGAjfVl%2BlVk7pcPslIPZNmqJAycyXUUz%2B7BjGUWLUk5%2FcHRh0rmQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c2fd58deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":70339,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 480 x 465, 8-bit/color RGBA, non-interlaced","md5":"95ee18d0114fd000ad2f4d71d7e694ce","sha1":"18864af07d81ba8ed080b3d013ab807e3e558c3a","sha256":"c5a73974a7cc2f30ba0bf1280f10994dd3d2c39b828f7c1a72c24bf9e14fe2a3","sha512":"d4aadd30d1e23e86011aa929f34d6ccef667607e9bd6ba19428f2602023bb9678efaedeb73a802fa04a26e05980fd7e671efde53914cddff403ad012537359f3","ssdeep":"1536:i8vXzmuCDICIwDQfjdXO6atYwHZwjcmuzcAW46Z27UbcG2fAO:ityJX6YgZw4mfAW46ek2Z","tlshash":"df6302adc2f7e046c5df3325ebba5bd787436bc33296d192ac06143ee811c425498f9a","first_seen":"2024-09-07T03:45:51Z","last_seen":"2026-07-23T08:23:10.251188Z","times_seen":99,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/2726f630cdc34585af71b51de2b89d75.jpg","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/2726f630cdc34585af71b51de2b89d75.jpg HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Thu, 21 Sep 2023 02:36:15 GMT\r\netag: \"15db29c3bfd5e072b42697a5c8e73081\"\r\ncontent-type: image/jpeg\r\ndate: Fri, 10 Oct 2025 02:39:42 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 726770938819215980\r\nx-cos-request-id: NjhlODcxZWVfY2YxNzc3MWVfNTM0MF8xOWRkODY0OQ==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNDg4MDk5MzM2NjI3OTA\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3255\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 13897005797287245039\r\nx-cache-lookup: Cache Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3255,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 96x64, components 3","md5":"15db29c3bfd5e072b42697a5c8e73081","sha1":"3b8b304ab9a53e33d2fa0185feeba6893d00536b","sha256":"cc21e5bbdb641e80ca21a41f0184a3e677cf9ef06255e5134fdd79aa1b764bc6","sha512":"f5daf9d8cf865cf4bcb7b88dac4f8463cf921b2721f56cb6d6d5dd48b4fe8664e41cfa19b869408337e87a2571553339268072c32820fdacaec3f89735dd4947","ssdeep":"","tlshash":"ad613b59e453fb4adb9cea3925f248369e1c54d0b285e048bcfec81e64240f10d7eda5","first_seen":"2024-04-24T18:33:21Z","last_seen":"2026-07-19T01:02:47.436315Z","times_seen":45,"resource_available":false,"data":null}},"time_used":837,"timings":{"blocked":812,"dns":0,"connect":0,"send":0,"wait":23,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/style-img/alert.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/style-img/alert.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 3209\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hviHvKEsJ4vnYJ8FPDs%2BgoWXH3I6GASOlU0QFT%2F4HTbaRrseVBCwSpZiEmoSy0TomKpPoLANSRTeASE4t8dJJUj5XgHluZF2VDTnWGeS4sbIiPYU9v0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c0f958deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":3209,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 86 x 86, 8-bit/color RGBA, non-interlaced","md5":"647348a6c16dc7ffa7582cef63d47247","sha1":"8ef22a07be992cc94060b8b855be9ebfaed98d9c","sha256":"5717e656143df2f6d333dc7d08fe1c25727cd8a2076e5d8242e65cf256e8a1ef","sha512":"37c5015d0dacc74599d823f894c05d31a6da0d307ad02cebc3ccf28c87e383fa5e66e02895ff8e19890505778daac9cb3edf04f0880cd9b69040fda685a4a77a","ssdeep":"","tlshash":"e2615c6a90a27ec7f575322f59792884c0f989d6f433267d3c18d5b108cd7a7467051f","first_seen":"2023-11-05T14:08:59Z","last_seen":"2026-07-25T23:58:14.649069Z","times_seen":286,"resource_available":false,"data":null}},"time_used":188,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":188,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.029Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:07 GMT","end":"Tue, 03 Mar 2026 17:10:06 GMT"},"fingerprint":{"sha1":"82:59:95:33:5E:76:7F:3E:5B:45:F4:CA:83:29:7C:B2:19:B0:A5:C0","sha256":"A1:28:19:D2:C4:EA:69:3E:6D:8D:7A:20:FC:3E:A6:13:BA:59:C5:9C:DE:7D:D1:25:3D:35:68:98:FC:47:82:9D"}}},"request":{"raw":"GET /ajax/libs/jquery/2.1.3/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29707\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:34:39 GMT\r\nexpires: Sun, 17 Jan 2027 18:34:39 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 236662\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":84320,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32180)","md5":"32015dd42e9582a80a84736f5d9a44d7","sha1":"41b4bfbaa96be6d1440db6e78004ade1c134e276","sha256":"8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3","sha512":"eda31b5c7d371d4b3acced51fa92f27a417515317cf437aae09a47c3acc8a36bdbb5a5e70f0fbfd82d3725edf45850dde8ca52c20f9a2d6e038b8eaaceee3cf1","ssdeep":"1536:AP1vk7i6GUHdXXeyQazBu+4HhiO2wd0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrb:z4UdWJiz6UAIJ8pa98Hrb","tlshash":"a283d6d9b2c67062977734b851bf410bb17a98dab80c8c60f0a4d4e47eb4a8d517bf2d","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T16:52:45.073576Z","times_seen":16125,"resource_available":true,"data":null}},"time_used":1491,"timings":{"blocked":683,"dns":2,"connect":8,"send":0,"wait":9,"receive":8,"ssl":772},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/821807bcb8b09695389119ca62eeecdd.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/821807bcb8b09695389119ca62eeecdd.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"e63c1f67df6289456b01d42a291f0d18\"\r\ncontent-type: image/png\r\ndate: Mon, 21 Oct 2024 18:05:00 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 11247417401204316228\r\nx-cos-request-id: NjcxNjk3Y2NfODZlZjc4MGJfMjcyMTBfYjJmOGVlNg==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDgxMDc5MzA\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 7193\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 558612242165248718\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7193,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"e63c1f67df6289456b01d42a291f0d18","sha1":"8a02133aac57a9de863144dd4488d58b072fdb96","sha256":"4cc861f22423295e6aa783d42fe48758704158254a608945d0443cf12b88b258","sha512":"4b148ef7349ec890d02fda04e8419f823cb4cd8ae953bdf9c726861082652bb7b0c13b2a8ff43063b1f915f6acb6a1f303ce840d1322dfffcca34e1f797efba6","ssdeep":"192:E/Lsi+poMn7+rUmSYSumePlusdda9Ogt46HmId:MQpoM6SYSZcVdoHJ","tlshash":"dce1a0de6cc556742ea7ce078b24ecb4eb35853334ea3d5db013da46a57f1081808e09","first_seen":"2025-01-22T15:28:39.24145Z","last_seen":"2026-07-19T01:02:47.58801Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1654,"timings":{"blocked":853,"dns":0,"connect":0,"send":0,"wait":800,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/sgiyvv7.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.525Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /sgiyvv7.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Wed, 26 Nov 2025 17:11:10 GMT\r\netag: \"342726b8e01fc7bb00f490eb0975ae48\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: PHL50-C1\r\nx-amz-cf-id: EyhO6O5Hk9juKpg6yxDP-wHuP8wto5HuhkzzhC9KIKJvgv45vY4jWw==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 479711\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nx-served-by: cache-iad-kjyo7100080-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 24, 0\r\nx-timer: S1768911541.140517,VS0,VE1\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 9687\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9687,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced","md5":"342726b8e01fc7bb00f490eb0975ae48","sha1":"52c189eba2f8c7b2295cac6ff9067091bfbeca49","sha256":"4538cdc8cc6c9cfb8ac8cbfb9fefdfc8cd4026fa3ed828f85b8f8bbd75d785b4","sha512":"0c2c7f056486a6f62440c5b039597a077c77e2f5e9afb585fbda3a63fa2c36503dab8690a37d714d14d84b5b25731104e17e9ac77381cc942fac80e6719e06d3","ssdeep":"192:bRFWLYdU0k6D8QoAjijNLGE8uCgwmKoji3ADOo33YDE9UmVEFIqp22Nw:NQLYdU0k6DWAj2px8uqDA6H4HIJw","tlshash":"ba129f91d339c07d3ae369aa2494f904bb1926749325f0ee37614b6d390cdd8eaf0e4d","first_seen":"2026-01-03T19:33:29.802693Z","last_seen":"2026-02-10T22:46:25.35966Z","times_seen":5,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"midasx.specialfor.za.com/img/style-img/icon.png","fqdn":"midasx.specialfor.za.com","domain":"specialfor.za.com","tld":"za.com"},"ip":{"addr":"43.160.250.121","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://midasx.specialfor.za.com/","date":"2026-01-20T12:18:59.853Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"midasx.specialfor.za.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 15:04:35 GMT","end":"Tue, 14 Apr 2026 15:04:34 GMT"},"fingerprint":{"sha1":"A8:7E:28:CC:65:CC:16:0B:81:54:D0:BE:A2:E5:A1:1B:8C:13:CA:94","sha256":"E0:71:24:37:45:1F:2D:76:DC:BA:27:3B:72:B9:99:E4:A4:B6:D4:BA:25:06:EC:22:C6:AE:96:8E:A5:36:88:86"}}},"request":{"raw":"GET /img/style-img/icon.png HTTP/1.1\r\nHost: midasx.specialfor.za.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://midasx.specialfor.za.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Tue, 20 Jan 2026 12:18:59 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":796,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-07-26T19:08:54.169483Z","times_seen":52340,"resource_available":true,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"midasx.specialfor.za.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"midasx.specialfor.za.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"midasx.specialfor.za.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/6775.989832d5.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.954Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/6775.989832d5.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 20673\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:12 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n4AF4FBg48hc%2FEtRsp%2FJzQ28zQBjWaUlOVFkNKb7HDGee%2Fsy9AtrLf97RuaXqQrMfZXVGOqKES6v7hvEM0LzuqXxpgBmp6hD6yANcpoM0WnEwo8B1ls%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a6ad28deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":234840,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"46ba6871b07c376359c8600095ac78f1","sha1":"bdef0420749aa671f246669265a543eca818dad9","sha256":"ff9575fdc71b70b7e0ca074e5a8f639dbbba03c5529ea241ced633a7b524dbb0","sha512":"e9df4c997a5444f00914cd3647bee4b2cd6eda79af376abda2e1404ff83c41eb2b8bda5eceb5c0633782c57cf2f35d36f4b4074e0510b805ebc19cc698df70a5","ssdeep":"6144:Rb9M9R2/2K2t2szSzRzRzg050U0v0OeseDepekNbNuNxN0UuU1UzUu6F64626n7U:Rb9M9R2/2K2t2szSzRzRzg050U0v0OeR","tlshash":"b234c61bc51269466633bbf1fbd7449deb3114a3568619a8fedc210a0fb32b8d046f9c","first_seen":"2026-01-03T19:33:29.77673Z","last_seen":"2026-07-23T22:44:16.911667Z","times_seen":10,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.962Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 13 Jan 2026 22:16:05 GMT","end":"Mon, 13 Apr 2026 23:15:55 GMT"},"fingerprint":{"sha1":"D9:00:47:77:A5:47:66:A1:6F:DA:EB:4B:BB:BF:67:49:BF:2C:A4:75","sha256":"07:A7:3E:4A:B2:9F:0A:07:6C:78:A7:7B:DC:2B:68:A1:84:7A:7F:1B:45:6C:71:8E:5E:79:F3:11:1A:6C:4F:62"}}},"request":{"raw":"GET /ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css; charset=utf-8\r\ncontent-length: 5845\r\ncf-ray: 9c0e848a9e9356a4-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"5eb03ed9-1149f\"\r\nlast-modified: Mon, 04 May 2020 16:12:09 GMT\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/kv\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 367966\r\nexpires: Sun, 10 Jan 2027 12:19:00 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=VYxqkBgWdhgwLrArfIYV0iwfGNUEYqz5onkURD2KqkgIkkwcFqSMgYOWkz49j%2F5m9bZeCoHxf46VFu1s7EaH4l17BvfVhTXI7IMTfMLlJ0RPr4G9IHKChz67SLbpfGrecO6eesw9\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":70815,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"e9365fe85b7e4db79a87015e52c3db6c","sha1":"2e2b5eb6e08f0f3d11fe0ada97c962a23ba6a0d9","sha256":"dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56","sha512":"ad142d178576c2d02f5eca2ee22500b369171e2dcb8fd344ef1251efb0c4ec61ecc6063d4535b2f77773317803206f13a224530f8e55b0335d4e251a80e15e64","ssdeep":"768:/KvcqyF7I4rb84dLM+JKvcqyF7I4rb84dLM+k:B/nLMu/nLM5","tlshash":"40631be8e80900d26fb1cc03ef62b7ca1685f0a3f9d10dd8f17a998c29d16551597fab","first_seen":"2023-04-05T03:25:07Z","last_seen":"2026-07-26T15:58:31.500568Z","times_seen":10697,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":2,"send":0,"wait":21,"receive":1,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/bape2.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/bape2.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 91917\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Fg4wFlZKfpt49W1StyZKwj%2BkFSeh7e2IztTbRv0ghO%2F99c%2F7eIG3r%2BBCQIME8AwR9tm864X8K2y8LI2PA%2BLVV2vBI47fDQP95MUEYMlsvFSDnGql30M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b1cab8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":91917,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"4890ea71c6c698a1d9b54a0aeb39de32","sha1":"f19a845ba4b02ba65ec0d93a37363a316220e0cd","sha256":"61df71ae32cd293cf14e5aab6c3984cf34baf6ab544d227896cac07b3be09d61","sha512":"a8170816ee1500eee84f724ce7315008fe04bc1b0a388d8be82c3e5a3537fbdc51a7fd5c1e6510833cd3dee0174c3cea0046b1c0f8d70d0fee56bc0c8e3a61ca","ssdeep":"1536:DKmlhT2l7SOru8MxByqA2TCoU1Zw0ADgnce5lFW3K/5CkADA3i5Tg4t:DTX6hSWwByInxf0n75KDwi5Tga","tlshash":"c493020584bfd0b95d0b40baf2a61fd7dcd3832597e64b95c394039e7692fe02e5d608","first_seen":"2026-01-20T12:19:48.022562Z","last_seen":"2026-02-10T22:46:25.382505Z","times_seen":4,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/2.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.156Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/2.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 49773\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CSnQV0OARbGxl%2FBNhdycgIUOaFHH9qbe6TFiWsHQE9kLGNdqwaoj7ltGyetHfIp7qXFRqgxB1ET81iC70gbb0UgQGXXDfkyfLr1uT5Ec7JeStyczpK4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b2d088deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49773,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 280 x 280, 8-bit/color RGBA, non-interlaced","md5":"76d31ab574c376e0cc9e490f30331afa","sha1":"1db4e9ebe6cf17896254ff4666e71626e00d251c","sha256":"8b324857c3b5a0cdc5e4a85f63c76728fcf49fc581bc5384f3170645a7fc2ad1","sha512":"3d5bf59b4fcd36bb4e853578bd006a770e8f8b6931a3426334ccb3a0559d0898eadc3fdbebddf3ed3ebc418876c9fa03684b957b98b786ad428454a3f2918cad","ssdeep":"768:l6SxKULMW3iC1j5TUIoBEnj2WusC/S+7zTomIeJbZ4L3Yo7oNzBP4BgzX:MSxKoL19TKBo20C/S+boVKZ4rYo7oNhx","tlshash":"bb23f13604526d18bd4dc19a90112da3732859da914ee709ffd3eb4eea4f6b133a44fc","first_seen":"2026-01-20T12:19:48.024061Z","last_seen":"2026-07-22T09:48:01.266402Z","times_seen":11,"resource_available":false,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/7.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/7.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 33235\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dQf5IR88xms27uPdVOqkNNH0SDKv%2BOGkksfy1sRN2Uy4T2h1Fx%2FOUbmDhpSueGOvDo5yT%2Bu%2FqGzE%2BhRXWX4lJ8abqzQSOiPkKBR4EMij9UUOkU8nJpQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b4d488deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":33235,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"08e12ac5bb4770aa122054ce4a982e88","sha1":"10f18940e5cfcf3613574b20af2af5fb5e620c8e","sha256":"9c1be9388efeb3a026fa71e46869d84ea5b08408af7c61aaa88652e170ba8dd1","sha512":"87c228c77f9de96ec78c6ba44f74d4c5d6ed464268d3d3b446f2ebf5414e27dbaf356610921190dfb48639d3cce00f9731c72900481cec72cc935aec6ff01233","ssdeep":"768:Fe3fkaKCawhR1MCPVG0UhisiFANIX5YUNfa58Ym5CW4OzPUKr3WIJB/Z4QGQCcn:FykLRc1FVG0Uhui2bNpYuCWIKrJBvVC2","tlshash":"77e2f1dc8b9361f1958e448290314cbf4fdeb569c57c1f8d249d92f6801ee04eeb6993","first_seen":"2025-07-27T06:58:26.689162Z","last_seen":"2026-05-03T13:51:52.832438Z","times_seen":13,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/find/1.84558463.jpg","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.541Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/find/1.84558463.jpg HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 300293\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=csQXKLCBFyT%2BYIO4eByimMbhQPeGR3pJ%2FPEMTbSK0Sn2mDUHTGlfoMrHERFRNegs6TqrIfcBqDf0YKb51HGML%2B0adO5ic46pzQPlJ7wHA75RTNIkpRg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c1fc48deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":300293,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2460x1080, components 3","md5":"845584637878717c9f1826acf9fcbbd5","sha1":"53a4eeaab9cbb1267a6b072a037a74e25c1196bc","sha256":"ab5a2fdfd17a380d288304b941740f2b3cd5ab580202ebde0eb746e75e1c5d90","sha512":"cc2fbf284fafafb28b145487d809ace8ec7d4604036b8e9b5a1d7a3b2ea960c021e2fc46be6430368b14e5527601b927f2bfd37f2c5c42c7c8e241c0eecf18fc","ssdeep":"6144:2HqoMZjjJ+kuHSW1tpBtzTN+YOKELxCcGxkWnXfa8h9QpG:2KdjOHbpBtf7ELADCDo","tlshash":"de54223d5ff4c2a0f2b651b89b0293516841e56a46a126339573ee8bf33c5fc9d1223b","first_seen":"2025-01-22T15:28:39.070635Z","last_seen":"2026-07-23T22:44:16.923059Z","times_seen":28,"resource_available":false,"data":null}},"time_used":225,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":185,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/load.gif","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/load.gif HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/gif\r\ncontent-length: 6518\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mDgGWWP28YFIQGfB8pnEtZbUPltlNbxzT6OX1sVo5cXo9NNAn4LCsjo6VZHeTw%2BJ7ofEXHT481zhxEHD6P8mY9IAKLm9VLRI5JWyn5dp%2FLHU2ZcsT%2Bk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c2ff38deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":6518,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 164 x 38","md5":"144bb7d6f1e1cb408835fcd849acaf41","sha1":"8bc47b81f5b2231fe6ef713f70dfff07961c6720","sha256":"9a8c5f0bc8f65663a4bd8afee1623cfecb94f3c327e86705685f46a622ff6b66","sha512":"d90bd8fd31eb60cb6f64ce6c7ea06ef6814e15982fba76c283496f798d15474c0f230a93bba250b219ec9912aed16b5d3686072a348c3d6e7481b1b7cf9f1442","ssdeep":"96:62OdLI7ETbpPx/7LI7EkJTLI7EWLGzlLI7EULI7EbLI7EdLI7EhQGv:kIQTl1IQEIQMGhIQyIQvIQFIQhQGv","tlshash":"83d1b63ce3c1be14e4446a7a94af7f3d461459346b58166f306adb20ba123fc9e4c3d6","first_seen":"2023-10-28T01:32:47Z","last_seen":"2026-07-25T23:58:14.652986Z","times_seen":305,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/lenzz.fb053b3a.js","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.007Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/lenzz.fb053b3a.js HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 2949\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\netag: \r\npriority: u=2,i=?0\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Qbe6oaNqJXALI%2BgjchW9zsaKWsSUjNW7uhHt3D8ccHpxg7N0jybchuIXXnml7IIH%2F5nqNzE32Tkl0in%2BmUy5xkWmtqdBwkDCTuqDy92q65%2Fk3KDOC%2Bg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848aab908deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":24889,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"bf637ae8f033ba448fd2915fd13225e0","sha1":"9355c61c57c96d485511b836acbb9559cf6141ae","sha256":"e91c75efa11265a18f108f2b4a8c76ead095f207ecd9981384c2bae0dc51a3e6","sha512":"5db0cae5005c66872b99d80fa444c0c0cfa5a07f5f82f15786614c46dc588b7bab68833607d97a4d21956fee23cf39c791178219ee78be8a43bef9ba4b64a4df","ssdeep":"384:veivMiyzYFBr9R3FvLF6c7Onfpt6OxeQkkQqoflTvz0tHwGSCA6a883K06:vvvByz9c7dGa6","tlshash":"b3b20109b6d61d912d37a4b611bb40043b5c580b150adf08f87d6ac82f51fbafe77a8e","first_seen":"2026-01-20T12:19:48.028798Z","last_seen":"2026-02-10T22:46:25.355924Z","times_seen":4,"resource_available":true,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/u9ZtEZZ.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.124Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /u9ZtEZZ.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Wed, 26 Nov 2025 16:04:58 GMT\r\netag: \"a7356a69fd21f937ddd1f227ce36db13\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: JFK50-P6\r\nx-amz-cf-id: x-vprI4-BRzPURofelNxWSdYJTrL123uhXro4KaDBLFvXu9ogzgl7g==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 775691\r\nx-served-by: cache-iad-kcgs7200134-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 11, 6\r\nx-timer: S1768911541.114453,VS0,VE1\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 268420\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":268420,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1122 x 488, 8-bit/color RGBA, non-interlaced","md5":"a7356a69fd21f937ddd1f227ce36db13","sha1":"c6c2e39db08ff9e807f729351866195cee2219b9","sha256":"f501208fb6edd2d02b276721eeb99320b61396c59aee5a0b88453083ad04bfc3","sha512":"3832ff51c10b6f809a35101f6d9d298eb501ea21d2874f65b4b5f0fce8e892fbbe7dcc1774fac778b1d5ca31eee52b6487b7366e4ccb932664d12853de5fd3c5","ssdeep":"6144:edLrWxNukVwnODATB6SX5Wi4JIQlBppEj0Khy+DaV9D:ELrKInLb5WBP5eZhKzD","tlshash":"114422059157e97c5cfbd5b12d0a2788ed32883852d36267fcce77896a23d0920fee15","first_seen":"2025-12-13T04:44:10.85892Z","last_seen":"2026-02-10T22:46:25.44074Z","times_seen":8,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":-1,"dns":11,"connect":31,"send":0,"wait":21,"receive":135,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/media/close.mp3","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.278Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/media/close.mp3 HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: audio\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 206 Partial Content\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: audio/mpeg\r\ncontent-length: 12675\r\nlast-modified: Sun, 09 Feb 2025 21:30:18 GMT\r\npriority: u=4,i=?0\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\netag: \r\ncontent-range: bytes 0-12674/12675\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2db3lCR3xoPvaiOluqChdvEcZJ%2F3Hd9A8tnk2I1dbBGY4iyWWLNSKuhxhCIfoXyeUrNZbju41teNql%2B%2FZiirhHT4Gz6aWXmZR8%2BFaORtJFR0wPmEK74%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e84933c628deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":12675,"size_decoded":0,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo","md5":"2056bdcfbd551273ee207f8c6ff9d257","sha1":"6fe68c9917d3409710aee4147ada311093d33ba6","sha256":"d7633fdf0d543880acc3fdaf578728d7becc1ff429ba054921d3313f73a5a4a7","sha512":"01a0022764f49e0c395d9f40fc73f123a424401e388d05373ab44ad33bd046d106881bd1f158b417030eabd8c9b52504d19155c225a1a632ef3c99ffbe771399","ssdeep":"192:kI/h/NAQ/Qa4cLtUDImzKBlSV9hME7Be85sqHARf9jt5EIJMcL:1/LcktUDBzOWX7Be85sGIr5EUMcL","tlshash":"0b429e012b05c12ff7292f7d301f86b8e0983a8f2a22cfe1a0179f94887f151672d954","first_seen":"2023-04-07T19:47:22Z","last_seen":"2026-07-25T23:58:14.63588Z","times_seen":747,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":188,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pro.edgeonetech.workers.dev/?v=https://cdn.midasbuy.com/images/EN.e6fa2f58.png","fqdn":"pro.edgeonetech.workers.dev","domain":"edgeonetech.workers.dev","tld":"workers.dev"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgeonetech.workers.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 03:54:13 GMT","end":"Mon, 09 Mar 2026 04:52:54 GMT"},"fingerprint":{"sha1":"F4:B2:62:FB:D2:D4:1E:2A:1E:50:BD:8D:39:B6:F9:40:95:DB:46:12","sha256":"9F:03:DA:8F:5F:BB:ED:ED:4E:60:40:13:20:94:04:33:9F:BB:5F:E6:43:E3:5C:1A:69:94:B7:FB:BD:7F:99:14"}}},"request":{"raw":"GET /?v=https://cdn.midasbuy.com/images/EN.e6fa2f58.png HTTP/1.1\r\nHost: pro.edgeonetech.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sHTMyX31JFn050rer%2FBoJg0DqzYPYN7%2Ba%2Bx7W4sm6RQCuwtHGRjfI%2Bc6LoPsAI%2BAWh6h4XtkP%2BCp8bpVlD68lJedQ%2Fj%2FQZ156Sx996pBJlXvgSVw71riNeY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c0e84944f4e7127-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/bg-item.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/bg-item.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/css/style.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: image/png\r\ncontent-length: 20086\r\ncache-control: public, max-age=604800\r\nexpires: Tue, 27 Jan 2026 02:54:17 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SwLWriQbgYqy3wqgN8Ez2U8ghDmQ%2Fc%2Bxi8MxQ99LEN%2FfbpFAdDpCjiiFWJMLKul%2FZByaYyAWDBnFYqm2B1OriUsI3yiSa0S0qDJ5FdgVDQW5TnA2dz8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e849509f48deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":20086,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1632x1632, components 3","md5":"bdf3142535e0b2558eaa41e064df57a3","sha1":"a1be2fc9d34c0bfb25eeac746e5533e2424be53f","sha256":"87b730c4e7516de36135cc25458deb7b30818e829c6c491f615f26f82b808812","sha512":"bfad575f7cf1a5b250ca9dcafa4bc6dc164730e8cb1fdf5d9a22a822ff5922c129385707936cfdc4b6f596b4abc86be9c0b5e8263c8cc6d7be5307e6caaa210f","ssdeep":"384:WTJ1Mt2wQiy6HIu1d4qlivUMmu19RXJaDOJlWp51mPYKhLyn:yWtd3Iu1d4xz9iElnLO","tlshash":"4e920773eba2a6d7c09c337585cb26393b1a0da7d25c5907a6c90d3478bb354bc4e6c2","first_seen":"2025-01-22T15:28:39.247493Z","last_seen":"2026-05-13T13:04:07.214346Z","times_seen":12,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/60855adbbdc396b3a4c349f14add0d69.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.217Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/60855adbbdc396b3a4c349f14add0d69.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"3b6531a792234bdf9571cd6a8561b6fd\"\r\ncontent-type: image/png\r\ndate: Fri, 10 Oct 2025 03:36:03 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 13581828408463138716\r\nx-cos-request-id: NjhlODdmMjNfZTgwZTc5MWVfMmQ0Y2VfMTlmNWIyNjY=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc5ODQzMDY\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3177\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 1692978185517763255\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3177,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"3b6531a792234bdf9571cd6a8561b6fd","sha1":"2029d4fccb902e1381170523cd6bbbc62dd77cdc","sha256":"06ef03fd9107c454bce3d7393c802402d4b6254440823fadf5b7d16107b5382a","sha512":"7db8acd72e70105c7d0e1dfdc2defd156a9113f4fbd4ffa49843e3b1de97dd11c05b8b1036715e5680832033d664480918a45aa837c58915883819dd58f406ad","ssdeep":"","tlshash":"22613dcbf715f9a76953513a513eec24521b7d980158c6cccc9bc18fa2c51ee20d5eca","first_seen":"2025-01-22T15:28:39.220065Z","last_seen":"2026-07-19T01:02:47.528267Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1881,"timings":{"blocked":815,"dns":0,"connect":0,"send":0,"wait":1065,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pagedoo.midasbuy.com/material/1450015065/0e9de9cb3561f51f2fb937bd34f03a30.png","fqdn":"pagedoo.midasbuy.com","domain":"midasbuy.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.midasbuy.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Thu, 17 Apr 2025 00:00:00 GMT","end":"Mon, 18 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"36:C0:42:2D:03:4F:38:58:E6:A1:2A:40:FF:E0:C8:99:CA:D5:21:99","sha256":"30:85:DB:98:42:24:54:F2:64:05:32:EB:ED:AD:83:0D:25:C2:2C:34:27:EF:72:1D:D1:BB:C6:C7:B0:BE:EC:36"}}},"request":{"raw":"GET /material/1450015065/0e9de9cb3561f51f2fb937bd34f03a30.png HTTP/1.1\r\nHost: pagedoo.midasbuy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 13 Nov 2024 03:34:22 GMT\r\netag: \"44d26d7a678039f819144a9b935e8b06-1\"\r\ncontent-type: image/png\r\ndate: Fri, 15 Nov 2024 02:00:05 GMT\r\nserver: tencent-cos\r\nvary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nx-cos-hash-crc64ecma: 18192468951191887806\r\nx-cos-replication-status: Complete\r\nx-cos-request-id: NjczNmFiMjVfZGZiMDQ4MGJfMWM2OV8zMjRiOGI5\r\nx-cos-version-id: MTg0NDUwMTI2MDQ4NDY2ODc3NTQ\r\ncontent-length: 33331\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 1149068857486134693\r\nx-cache-lookup: Cache Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncache-control: max-age=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":33331,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 140 x 140, 8-bit/color RGBA, non-interlaced","md5":"0e9de9cb3561f51f2fb937bd34f03a30","sha1":"3d6879bc28321f6e729b0731f6a1bbdd2cf6877d","sha256":"69af9942ae1c3ce709c358a8c28675d8fab6d35d721eedf4dd5201facaf77e62","sha512":"f95356b5951bd653fa3753b3a763ee74203b6d93e84bfce986454ac5ae7a48c037fd1cb6aac45a2b175c22b095a969ff1377544cffc88355429026c5685bd1d3","ssdeep":"768:KAvhwbFM4FdK2jAWhnNJKAfNa85QPw1I/Ul+zIEgY:TY+KA2MWhNQAfk85QPwNgzIEn","tlshash":"d4e2f17d41ed18750ecf17fd2e2c8ea6523a7d11029a9a47edb0036e71d9d101ee3aa3","first_seen":"2025-01-22T15:28:39.165707Z","last_seen":"2026-05-13T13:04:07.264584Z","times_seen":12,"resource_available":false,"data":null}},"time_used":1045,"timings":{"blocked":1032,"dns":0,"connect":0,"send":0,"wait":11,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/6b5b90bfdeca819d6a45171e85b81fce.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/6b5b90bfdeca819d6a45171e85b81fce.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"81b94ade773a1869fe01d031db36327d\"\r\ncontent-type: image/png\r\ndate: Mon, 21 Oct 2024 18:05:03 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 13652087803389900638\r\nx-cos-request-id: NjcxNjk3Y2ZfZDA4YzdjMWVfMWYxMzBfYjJlOWUwYw==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDgyMjczNzA\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 6835\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 14406726868888798163\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6835,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"81b94ade773a1869fe01d031db36327d","sha1":"b448968f4de1f24e634893c0831b3f3bf8e2fc92","sha256":"1fd19cd69527b2137ee3c99d32b3d95b5316e0376bbb57b9cdafb12e8e18c069","sha512":"0178a639fd748cbf8384aae3b37f811ac2cac650bc3b33edf139d9a3bc883eabc3372cb8c97bf22821ffa787d6966b8b679412fc382afae8af1a990492c17f8f","ssdeep":"192:1daGgkirwKwTEYDOOQE6xYcu/BnJngIE1xlRSc:9ZrTEYDOOP6mf/BJDE58c","tlshash":"0be1afe81a52de868474b558ae90b91c15d7201e21bf38f32cf64973ad5d0481529ff6","first_seen":"2025-01-22T15:28:39.175067Z","last_seen":"2026-07-19T01:02:47.532869Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1442,"timings":{"blocked":644,"dns":0,"connect":0,"send":0,"wait":797,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/style-img/icon-twitter.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.412Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/style-img/icon-twitter.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 5997\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BuuwdlVp2TdX5t%2B2lc1WK98qy7A5TgRedtDi0uFJx5BtRcVjo35e3v%2FiKuC237xPoi6d0AoFpNdtl9YeoCdbr8U44gT%2BaIFFMimpNNFCCpiNTYwSA2U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c0f798deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5997,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 86 x 86, 8-bit/color RGBA, non-interlaced","md5":"3102bd5ece1855fd21122d8f0e2f6b43","sha1":"79e8a83aa0eaa45dd07914726ad40736fd0bcbcf","sha256":"4b3a0f6de375b108b3fd927b85f45660478919a1dcc7051ff227e4bf8d49d9de","sha512":"3c2cf28e956f19e6b8ff56a50f3e4a9cca00db32fefefca05679756d422905c0030f9a1ef7923eff4c7b907b600e580e064a76fd1ccd6f13353e209ce22c4c3b","ssdeep":"96:5KbjeqR6yWefSE9K4JoARywhJfepn0WS3IBPLWbqhqtf9Xb/19R5mz1FfHfpz2:wLpGGyypOn0WZGq4fLIHxK","tlshash":"c4c19e3c04bc78bd2173434781655d2c461b09a7f608cd7f7ca2c9b483a9681dfda622","first_seen":"2023-11-05T14:08:59Z","last_seen":"2026-07-25T23:58:14.666494Z","times_seen":287,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/fonts/DINMITTELSCHRIFTSTD.0d145998.woff","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:03.086Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/fonts/DINMITTELSCHRIFTSTD.0d145998.woff HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/zone/login.1b93034a.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Tue, 20 Jan 2026 12:19:03 GMT\r\ncontent-type: text/html\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: BYPASS\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ik7QYZ%2BtsFEf48RN30QUPeGgNmDlTEMmMeI1ExcZPAbeC4gbIXDip%2F5JN8gX6Oh25DXD71BzV9ezwuPS0%2B0BUVrTqqdmCp56cEsjpNKt9bQnTNA%2FrBE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e84984bd58deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":796,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-07-26T19:08:54.169483Z","times_seen":52340,"resource_available":true,"data":null}},"time_used":190,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":189,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/1889.06cd5bb7.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.877Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/1889.06cd5bb7.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 16227\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:09 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Wz52iHhP33%2FinqBfR0zBJ0Ikz52NaGtrjlUgTDB%2BTl1xWm6pDef5oDVyOWeYHA%2Fs2dy13b85YiWM1PykHxoj4ZJtZuWyptQEgD%2BRzDjdfj4aMP9LSbE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a19e08deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":215401,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"e1b33a7871068ed00e3dd4dfbc40b1c1","sha1":"474d12394bd1d64677ff70c5637f38877d216804","sha256":"b768df8da346323bc0b5e1ccfe1765c2961953bc83a8148665c3937f6c07c35c","sha512":"8ec1574effb87a2bcd444c894ab90141944830753a1c43c02033ce4ee35e8664bd2a442a08b7ff71d4e4214a0581eae7aff06c828652281b6aa7dc586da35948","ssdeep":"3072:Zb7byIMI6IOIr+1+p+a+vnmnUnYnF6v6b6K6bdod2dKdb5x515M5NyCyQy5ycQr9:Yxva/At//OSdD","tlshash":"d5249555ca124916ea3b5fe1ef9700a9ea1058235392c93cbecca50e9ff81fde111e5c","first_seen":"2026-01-03T19:33:29.68159Z","last_seen":"2026-02-18T03:17:18.023724Z","times_seen":8,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/7680.54f64d50.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/7680.54f64d50.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 10567\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:08 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W03se21PYKaIpRTDXCN%2F3CYy3AayU5YldVo9A01MbjNHYx6KUAo6M7RKwQmHz9VUJbzw2TLpFoSRgRmt%2BdQCHclj1idNumGjIaC6cBO7BdGFyRSrSsY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a4a738deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":112651,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"f682d60173f6ada6c4d721b422c147a4","sha1":"a1c72deb1616ac122131c3517e0e1c222c5e3c1e","sha256":"977d88b0fbabcdd0bb5f70f2b90f626d8fbd16385c5e371a172360b1888159a4","sha512":"1163f61edd80f8d15ef486bac22fd12604a3b743d3d0769816c102cc47f8184254839465c4603aee2f402c942986b25436dcbfdff3de5d92edb01dd961dad83f","ssdeep":"3072:GgVCGsKqa6z398emKZwkV9lSGVAWvCMsw8KiVSsC:GKCGsKqa6z398emKZwO9lSwGK","tlshash":"75b31c958c02888e33377fa2dbaf5e1cdb50117757e30678bd8c27864f729b82951e98","first_seen":"2026-01-03T19:33:29.790155Z","last_seen":"2026-02-18T03:17:17.924124Z","times_seen":8,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/css/google.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.998Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/css/google.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 1402\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:11 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BxXgdNrMkJpp2nxlWFuUNf7QlykLHgCQuNcNUUzWDwMWbjJZ1mQMr90HZ6KvsJQM%2FljzGBVHPPWRT188%2B6tU1vTxUNUVxC3V1FVXrmDiHNkgRBbZY34%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a9b728deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":7548,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"6b152699476854bb4c139fffb3519635","sha1":"8c981380a5a3c1c2ab0e87daf1cf5da1538ca1cb","sha256":"dfd32d82e39b0b720e9c9c2adf95c4b65ee95ff4f8649f6dbf96425fed89f87f","sha512":"e5ef09d46a94481991287a8cacdf8d11514789d0f21e862b40955cb72f1a8cd1a08551bac215a20d0696ba5dd598ba72b583f768f4f4bf951188137e33eca440","ssdeep":"96:cObJ8PC4vIQwMORAT3Ls6LCLlQMk619By6gBxOBurUXVIoC0AU/+xOXKK3KKk1:c08PA4bs6LCLlQ16PBy6soC3U/+xu9m","tlshash":"70f1df5aeb106009b132dbb8bbb24b45e91d04639b0785b9bb9d6340cfb156c5372fdc","first_seen":"2025-08-08T20:20:25.057934Z","last_seen":"2026-05-13T19:15:32.300065Z","times_seen":19,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/b0eokCm.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.128Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /b0eokCm.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Wed, 26 Nov 2025 16:47:15 GMT\r\netag: \"410d09b7fcb143f61fe1991983158d0f\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: H7VYDxEoP7qfsEP6YH13fR7f8NWr-Kd40DWU2zOIHQxtEIMydBOUIw==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\nage: 711522\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nx-served-by: cache-iad-kcgs7200083-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, HIT, HIT\r\nx-cache-hits: 41, 0\r\nx-timer: S1768911541.127044,VS0,VE1\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 2863618\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2863618,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 3464 x 3464, 8-bit colormap, non-interlaced","md5":"a4ab8d314547df24e8a51cdc078b8bac","sha1":"ca7967bd18704e123b18b1dc98ba083e7f6246d0","sha256":"6339e805583781166bb2e2691b43ec5cd65a894445ecb76f2562467dcce0a809","sha512":"215a0e7fee6712c3fcd3cb5bf9519e2e140c91f7d8ee83a0c5b93efa467bd33366c4f021740b1b709a1a8ebfeda8f5d2029e17db7147abf399d55514b56b14d0","ssdeep":"24576:xfmOZI99XoLF6SYmuCGvOIj1osPK4DeqHgrl6LyRohORA2:x52XoLFbuCWJj1opqHgYOj","tlshash":"66253386ed82d58dad1b0131c2c7b1b02fa0e982d7d8202e91d5ffa15f05592de9dbec","first_seen":"2025-12-13T04:44:10.861267Z","last_seen":"2026-02-10T22:46:25.357299Z","times_seen":13,"resource_available":false,"data":null}},"time_used":917,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":864,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/reward/3.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.158Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/reward/3.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 43267\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SNZ%2BHw9q7Qnt2iWd2XNMKlBQe4vTGq94wUvRgSVv9%2FXFvPycOVgkYhxIiUIzakwZ0jfrJUMjMqrIwRuKygwPymtAhrZn6zbScXctE7qsaBJqXl4GWP4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848b4d3f8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":43267,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 280 x 280, 8-bit/color RGBA, non-interlaced","md5":"e2238ff7534b7599e6b9996d1e93aa7f","sha1":"387a52faa6c526dfc6ecb2576fd4b69b7603367f","sha256":"d9e3f9f7d69d4d21d0e112ac59d58a3e0a45fc2d4b699ebb6f4983c6ff06bbe2","sha512":"73d52a59269473836a55d2fa181243d7a79e37c133adbb97936501a57a13598e769c9a594de09111432b637b04e976c44e1a1c05cc7142a60197da955565b452","ssdeep":"768:l2pRFg29HjnOL7jLHIgjaYPMBGlyJcnyxIowreiHHkV98Vak2PcZaE:lIFgoOjLJuYP0GkJcyxIowreiHHM98ZD","tlshash":"a113f104107c0d63719e00affb53ff5526d69a6004e61dbe299baf2edf6722a720b407","first_seen":"2026-01-20T12:19:48.04258Z","last_seen":"2026-07-22T09:48:01.306004Z","times_seen":13,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/be281be8b340500e662bf35df6dc35c1.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.238Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/be281be8b340500e662bf35df6dc35c1.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"f570e87ecc82504350e56871671dbe4b\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 15:27:03 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 9824401301893414281\r\nx-cos-request-id: NjZmNDJiYzdfNDc3MWI3MDlfMWZjMl83YjljOGNj\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc5MDgwNjc\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3723\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 2613972253660535575\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3723,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"f570e87ecc82504350e56871671dbe4b","sha1":"64fc4078875220b575639a7a8677a4295a081918","sha256":"692398d82c491ada2ca7e4ca1f238f2e7d7f5276a07d8a9dcb6fd5c864e19a98","sha512":"c6320896c7a8cae22d6c4afebd2de51d99136955e850d68813904c140cfaccb481203c19f4b31a8ea15917a25a6424fe3d9c35cad50f6ce6380c1b3db8c4d9f7","ssdeep":"","tlshash":"52714dd396b40a850b6b56ca76179ad4a7d3882b01e7184e33e233c08d519786afe14a","first_seen":"2025-01-22T15:28:39.217368Z","last_seen":"2026-07-19T01:02:47.575507Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1588,"timings":{"blocked":797,"dns":0,"connect":0,"send":0,"wait":791,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Cedarville+Cursive\u0026family=Mochiy+Pop+P+One\u0026family=Montserrat\u0026family=Oswald:wght@300\u0026family=Varela+Round\u0026family=ZCOOL+KuaiLe\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.987Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:07 GMT","end":"Tue, 03 Mar 2026 17:10:06 GMT"},"fingerprint":{"sha1":"82:59:95:33:5E:76:7F:3E:5B:45:F4:CA:83:29:7C:B2:19:B0:A5:C0","sha256":"A1:28:19:D2:C4:EA:69:3E:6D:8D:7A:20:FC:3E:A6:13:BA:59:C5:9C:DE:7D:D1:25:3D:35:68:98:FC:47:82:9D"}}},"request":{"raw":"GET /css2?family=Cedarville+Cursive\u0026family=Mochiy+Pop+P+One\u0026family=Montserrat\u0026family=Oswald:wght@300\u0026family=Varela+Round\u0026family=ZCOOL+KuaiLe\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 20 Jan 2026 12:19:02 GMT\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":226153,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1981)","md5":"3d81bbd23ae2b573faf227c168d23590","sha1":"ec9ed58786296918451c53cb1cc11c0eef0d99a9","sha256":"fffa3cf6cf95116b7b8ed5fa612d6aa866452016d2be95f257afa69993f5b3fb","sha512":"e4793c99e3aabc4e54d4dbce9250a94b52ef2f535c7bfa07ca7771ab62ae9bda0f0da647e93dcfbbe6fbbf0ad8d52c31a7babe49d5b3aff77bdcd86d9673d262","ssdeep":"1536:uVCN1Cm7Vx9GK3psfQas3/8krtsX5WV2YoWMrUNNISLsbmOfFQDnCq4aH2RDclZe:Hh77lyaukpHN67e7ZYNZ4gurk1Ia9","tlshash":"ed2401a1450755dffee71ca752ced925bea968bcf881883852f505c3ac0e01ad1cbb8d","first_seen":"2026-01-20T12:19:48.044575Z","last_seen":"2026-02-10T22:46:25.406585Z","times_seen":4,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":43,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/fonts/DINMITTELSCHRIFTSTD.ae4cacf317c4c9c6befd.woff","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/fonts/DINMITTELSCHRIFTSTD.ae4cacf317c4c9c6befd.woff HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: font/woff\r\ncontent-length: 24996\r\ncache-control: public, max-age=604800\r\nexpires: Sun, 25 Jan 2026 17:25:25 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ynrNEsbGSAQ532Fv43lOp%2FnO%2B2cD%2FcdPkOhHA5QBJ0yxBvQM2Bkwww0I54vXgqWjhJmhyznWJxxoJ8HIFCRGOLzo7lorpBNElkzJ3mytzTcttgNPEpM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e84952a418deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24996,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 24996, version 1.40","md5":"2018d35e708e07985693c6bc12a59861","sha1":"12faf69d54217b30d4458fffad689e758b8a91c6","sha256":"c2293fa86d99d0f1f06b2ac7f85ae0517e4a3bacfd9946de7b012f04aa2d831c","sha512":"5f80cb586d6a9c04f1f3e550283694d99fdb98bd37298dcddf94b1add4da93dfa315d123cf6527fd051a012fd38c0f9f642f707ce9f914c5a7075747be7fc42d","ssdeep":"384:HsmgD0cC1mO9aJlKA9BsPsjL+baPkl5kaa4t6+ECn9CWDBZ1hZXjhY4ev+Vmn:MmLmHJlxuPl/FT1DXjhE8mn","tlshash":"6db2e16940090d26c0722a71d3b293d8774053aee2d60eeb86790d6eddecd933c79eb5","first_seen":"2023-04-10T08:44:25Z","last_seen":"2026-07-25T23:58:14.633027Z","times_seen":520,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":203,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/6877.6d0fd829.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.858Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/6877.6d0fd829.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css\r\ncontent-length: 6545\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:07 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BpkIODCTOMbwzWn2nsGzXl9U%2FlfsATSmNELetWvhvBIU%2Bkm1Dy011vLwvPlMLxja1bNDp91CEz%2FdayKSBa7OSzOvilffsH6wqrUCDjuekRpltevCtzw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a09b68deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":33367,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"5ffe007a97cf123c620e939f15443ea2","sha1":"6cf91981d498e0fb068a79abb12b5939cb05f9ce","sha256":"9bfd203f1648980533b7ff8ea161e6d5d1ef9c564b8a9a132fc101cb33080bb2","sha512":"f97250b1c85386ca538936cba49d7f8aea4813dabadaa45f4b1c96b29ef38ecea351d79349c9c1533bea8e8b3123f22acfd332cc964dab3ca29d58add706262f","ssdeep":"384:CAXD0fzdA4RwEHCpSqTq+4penQH5QePyEDuz7grXQY1C9tMYaWloy5E:mi9qzZQePyEDuz7gLQY1C9tMz","tlshash":"e1e2cd5485128a0d66325bde975ee239da91729b5ce10f9ffbce6b232fe00fc5200958","first_seen":"2026-01-03T19:33:29.754222Z","last_seen":"2026-02-18T03:17:17.900668Z","times_seen":8,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/7960.77071778.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.892Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/7960.77071778.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 26022\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:07 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nHddQnTaWfXdcAZVKTGOMR3hQGay98yzMpjSBibY6Zp%2B8mRTr7ZSm0nmuVQVnqLAMWtS8C4jwPM8exo3qbzgwCHsZETogA3P3Quij%2Fx1qRts0SkHMf0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a2a148deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":245554,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"f4f77e096d0665a7fee04406c1170f87","sha1":"7ca26656a8b1070cd12d163285341b1154a68cd8","sha256":"713fba18eaa7307114e61df54db426f542b948aa929887ea6b5578675e18f4fe","sha512":"b66b4daaaa101a444c8b61710127580d87aca0900d5979d978255297226c8291b4ad3264b51866ffecfecb6b76c75f8da0505ba121396e719b33b5daa582344c","ssdeep":"1536:WTlzZzxl0t+1iQjtviQZiQ5iQrgTq0iQbiQ99iQzQCTKFiQbiQ87wmk:Nt+1VBVZV5ViVbV99VEVbVN","tlshash":"aa34c625cc235e4aa23b9fa8dfa74148eb243853e543697d7edc23584fb01b8215af5c","first_seen":"2026-01-03T19:33:29.757434Z","last_seen":"2026-02-18T03:17:18.050439Z","times_seen":8,"resource_available":false,"data":null}},"time_used":231,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.027Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:07 GMT","end":"Tue, 03 Mar 2026 17:10:06 GMT"},"fingerprint":{"sha1":"82:59:95:33:5E:76:7F:3E:5B:45:F4:CA:83:29:7C:B2:19:B0:A5:C0","sha256":"A1:28:19:D2:C4:EA:69:3E:6D:8D:7A:20:FC:3E:A6:13:BA:59:C5:9C:DE:7D:D1:25:3D:35:68:98:FC:47:82:9D"}}},"request":{"raw":"GET /ajax/libs/jquery/2.1.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 29671\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 15 Jan 2026 00:46:22 GMT\r\nexpires: Fri, 15 Jan 2027 00:46:22 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 473559\r\nlast-modified: Tue, 03 Mar 2020 19:15:00 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":84245,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (32061)","md5":"e40ec2161fe7993196f23c8a07346306","sha1":"afb90752e0a90c24b7f724faca86c5f3d15d1178","sha256":"874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4","sha512":"5f57cc757fff0e9990a72e78f6373f0a24bce2edf3c4559f0b6fef3cf65edf932c0f3eca5a35511ea11eabc0a412f1c7563282ec76f6fa005cc59504417159eb","ssdeep":"1536:kPEkjP+iADIOr/NEe876nmBu3HvF38Nd+uJO1z6/A4TqAub0i4ULvguEhjzXpa98:7NMnJiz6oAQKP5a98Hrh","tlshash":"db83d6d9b2c67062977730b850bf410bb17a98dab80c8c60f0a4d5e47eb4a8d517bf2d","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-07-26T23:24:27.534542Z","times_seen":59785,"resource_available":true,"data":null}},"time_used":1499,"timings":{"blocked":689,"dns":2,"connect":11,"send":0,"wait":17,"receive":3,"ssl":768},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=Roboto:300,400,500,700|Teko:300,400,500","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.082Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 17:10:07 GMT","end":"Tue, 03 Mar 2026 17:10:06 GMT"},"fingerprint":{"sha1":"82:59:95:33:5E:76:7F:3E:5B:45:F4:CA:83:29:7C:B2:19:B0:A5:C0","sha256":"A1:28:19:D2:C4:EA:69:3E:6D:8D:7A:20:FC:3E:A6:13:BA:59:C5:9C:DE:7D:D1:25:3D:35:68:98:FC:47:82:9D"}}},"request":{"raw":"GET /css?family=Roboto:300,400,500,700|Teko:300,400,500 HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 20 Jan 2026 12:19:01 GMT\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24899,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (1572)","md5":"bbb0673ff5bf4a8964b87445cad3abcc","sha1":"c6aa15eb0e0753794b8066cbf104f11dd340d52e","sha256":"2a77cc2f64f2636df24132aafae79359498c0b9d29422d88c0864cff622c16d7","sha512":"8ce126ca4337c662f7a3cf6480a50bb054ae79c7b55798a78a826397339fb5434e30daadf2195cd82f8f5b2cd55ad19ccd563e1d6af3ca3b4783607d9543c9b1","ssdeep":"768:38XguBSivFRa1KRzBfiiMgFK1GIBEiNnr7gr8yBOijh1T:MJiWt","tlshash":"e5b20ca1041b500097834ce223cebf35fe1f52507142d0b5abfdab6baddbc6652693ad","first_seen":"2025-11-23T00:37:31.222975Z","last_seen":"2026-02-19T13:19:54.484958Z","times_seen":82,"resource_available":false,"data":null}},"time_used":1433,"timings":{"blocked":633,"dns":4,"connect":18,"send":0,"wait":20,"receive":0,"ssl":749},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.midasbuy.com/oversea_web/static/images/big-new-close-icon.png","fqdn":"cdn.midasbuy.com","domain":"midasbuy.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.midasbuy.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Thu, 17 Apr 2025 00:00:00 GMT","end":"Mon, 18 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"36:C0:42:2D:03:4F:38:58:E6:A1:2A:40:FF:E0:C8:99:CA:D5:21:99","sha256":"30:85:DB:98:42:24:54:F2:64:05:32:EB:ED:AD:83:0D:25:C2:2C:34:27:EF:72:1D:D1:BB:C6:C7:B0:BE:EC:36"}}},"request":{"raw":"GET /oversea_web/static/images/big-new-close-icon.png HTTP/1.1\r\nHost: cdn.midasbuy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ncontent-length: 0\r\nx-nws-log-uuid: 3524962635242235693\r\nserver: Lego Server\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\nx-cache-lookup: Return Directly\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"image/png","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":2231,"timings":{"blocked":1026,"dns":779,"connect":9,"send":0,"wait":8,"receive":0,"ssl":405},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/18c55dfcf1979f56d48e1870b4f421c1.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.190Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/18c55dfcf1979f56d48e1870b4f421c1.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"b774c39776b7dd697ecf88fed774b8f8\"\r\ncontent-type: image/png\r\ndate: Mon, 04 Nov 2024 12:09:13 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 13057886671716270029\r\nx-cos-request-id: NjcyOGI5NjlfZWQ4YzdjMWVfMjA3ZjRfMWI4MWFmZQ==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDc4NDY0MzM\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 6079\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 2830443839382934085\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6079,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"b774c39776b7dd697ecf88fed774b8f8","sha1":"d66ff1dd99523a66e995fb8438e252ba1b5c9edf","sha256":"1098b18c70cefcd362a7e60e28189a42302d0bda259ced33efa1f2c92098a606","sha512":"fed5b8cb3bc37767597166a52cb0476c95fce43be9d896cb2ea65092f0b9137dd4c34e6afc1d76e713466de28355a790349414e8f243e850a50fe4c48486e52a","ssdeep":"96:e5/CTP1T2YwGH4PM3B2CxrwPbL2YYowx+bzhnrQ8TH89CxNVE6/KDFFh77RA0:eVy1y5GH4Pi1twz4ozlrPcMvJ/KDNd","tlshash":"37c18e4e495477f936aa21718a153347ab63c391efbe72253ce48433aae2c550837f24","first_seen":"2024-10-30T20:47:39.060318Z","last_seen":"2026-07-19T01:02:47.448665Z","times_seen":19,"resource_available":false,"data":null}},"time_used":2584,"timings":{"blocked":841,"dns":172,"connect":7,"send":0,"wait":770,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/4c58aa9464f6ad5893f10c49044eb73a.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.205Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/4c58aa9464f6ad5893f10c49044eb73a.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"5099a7c3bc291fd0d1370dd652b42531\"\r\ncontent-type: image/png\r\ndate: Mon, 10 Nov 2025 05:42:35 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 17672256454398081975\r\nx-cos-request-id: NjkxMTdiNGJfOTVjZTE3MWRfMTY1ZTJfMWYxMDI0ZTQ=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDgwNTYxODE\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2988\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 15489165549216370189\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2988,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"5099a7c3bc291fd0d1370dd652b42531","sha1":"930ba1dc859d5d2dc32c9cf40992a778f1a46865","sha256":"e08c85c77affacdf5a5f50a74a8576f04c81da4c49949e9eba692a0dc5bd39aa","sha512":"cf4b5af28e539fef955111d225d69a1ae1772fe11ce820c2c4fb3cd6c009d1df24abc5fdcf90569677dba9f6b09217ba893fb855bf8d103f657aeb42104f4904","ssdeep":"","tlshash":"55511a18d31f452f15245cbca09e619d8b7bc326d935a8079dbce029d8fc15fe2d5360","first_seen":"2025-01-22T15:28:39.236772Z","last_seen":"2026-07-19T01:02:47.486149Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1917,"timings":{"blocked":830,"dns":0,"connect":0,"send":0,"wait":1087,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pro.edgeonetech.workers.dev/?v=https://cdn.midasbuy.com/oversea_web/static/js/main.8f2b2f27.bundle.js","fqdn":"pro.edgeonetech.workers.dev","domain":"edgeonetech.workers.dev","tld":"workers.dev"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.274Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgeonetech.workers.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 03:54:13 GMT","end":"Mon, 09 Mar 2026 04:52:54 GMT"},"fingerprint":{"sha1":"F4:B2:62:FB:D2:D4:1E:2A:1E:50:BD:8D:39:B6:F9:40:95:DB:46:12","sha256":"9F:03:DA:8F:5F:BB:ED:ED:4E:60:40:13:20:94:04:33:9F:BB:5F:E6:43:E3:5C:1A:69:94:B7:FB:BD:7F:99:14"}}},"request":{"raw":"GET /?v=https://cdn.midasbuy.com/oversea_web/static/js/main.8f2b2f27.bundle.js HTTP/1.1\r\nHost: pro.edgeonetech.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WqR%2FcOwsTXcx6ot9AL4TrQJs%2FB4VQycLF1sAiMxIS7Qe1tg27bdJTLhGl3xEz0GzYmXpLgiDARD8hOUdtBUBBLqnErr3dS8tQ%2Fh%2BV%2FQymMNhRL7drTFfQcA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c0e84933e8b7127-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/style-img/Show-Password.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.430Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/style-img/Show-Password.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 28355\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YERWXs4k%2Fithpy62nSDfOixQk0jJGiQB31PdUdPRZp6058OXCbC26WH19nAwNxGRBsbMPvZyAoA0CyEejOlrgGKODZ2PwFvumDwbJ%2FmPWwBZkKK%2BXzU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c0f8f8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":28355,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 656 x 656, 8-bit/color RGBA, non-interlaced","md5":"2fd203703821d5ce5d18bee2a51b779a","sha1":"a78d7b1369ce8bc34de57909af142043cae446f0","sha256":"6b82611fa96f118128b0db9692dd982ca0fe79b1b4d8048946880600cc4f97c8","sha512":"f889c843a380cef9b5746614b9bc6ab067b483049cc03866953867e1e5ce2b5e1936c965975c88e2352a3ebd0d6a1840252edbf70f01092cdefc7e4cff1868b2","ssdeep":"384:O0uuuuuuuuuuuuuuuuuuuls7IhoG2PkCEbDk4otLQORTaxqw9YLFjKIUjuMYu3PV:D7NGasw4otBaMw9WF5UvjXP3nt","tlshash":"41d2bfe3d7b94ab7c9a53271a150924722221cb901bcb89810c0bf9e673e6cc6e76f11","first_seen":"2023-04-30T19:27:11Z","last_seen":"2026-05-13T13:04:07.256793Z","times_seen":916,"resource_available":false,"data":null}},"time_used":190,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pro.edgeonetech.workers.dev/?v=https://cdn.midasbuy.com/events/temp/bg-notification.png","fqdn":"pro.edgeonetech.workers.dev","domain":"edgeonetech.workers.dev","tld":"workers.dev"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:02.563Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgeonetech.workers.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 03:54:13 GMT","end":"Mon, 09 Mar 2026 04:52:54 GMT"},"fingerprint":{"sha1":"F4:B2:62:FB:D2:D4:1E:2A:1E:50:BD:8D:39:B6:F9:40:95:DB:46:12","sha256":"9F:03:DA:8F:5F:BB:ED:ED:4E:60:40:13:20:94:04:33:9F:BB:5F:E6:43:E3:5C:1A:69:94:B7:FB:BD:7F:99:14"}}},"request":{"raw":"GET /?v=https://cdn.midasbuy.com/events/temp/bg-notification.png HTTP/1.1\r\nHost: pro.edgeonetech.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ndate: Tue, 20 Jan 2026 12:19:02 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Mwwhj9ZqOIgsqFeU%2F5rGCCY2%2BmrtgsBaxjiGbqIPx9uAJF%2BBBLzxOP1pb9gpqI6wHmwu78aJcrNJHynmNY1Gn9YBdDv2Y%2BvYwAiURXNxf%2BUn84nf7fKhlyw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c0e8494ffe07127-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.midasbuy.com/oversea_web/static/media/DINMITTELSCHRIFTSTD.ae4cacf317c4c9c6befd.woff","fqdn":"cdn.midasbuy.com","domain":"midasbuy.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:03.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.midasbuy.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Thu, 17 Apr 2025 00:00:00 GMT","end":"Mon, 18 May 2026 23:59:59 GMT"},"fingerprint":{"sha1":"36:C0:42:2D:03:4F:38:58:E6:A1:2A:40:FF:E0:C8:99:CA:D5:21:99","sha256":"30:85:DB:98:42:24:54:F2:64:05:32:EB:ED:AD:83:0D:25:C2:2C:34:27:EF:72:1D:D1:BB:C6:C7:B0:BE:EC:36"}}},"request":{"raw":"GET /oversea_web/static/media/DINMITTELSCHRIFTSTD.ae4cacf317c4c9c6befd.woff HTTP/1.1\r\nHost: cdn.midasbuy.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://udgqcvkk.fortoday.asia\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 403 Forbidden\r\ncontent-length: 0\r\nx-nws-log-uuid: 16523094447498993489\r\nserver: Lego Server\r\ndate: Tue, 20 Jan 2026 12:19:03 GMT\r\nx-cache-lookup: Return Directly\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"font/woff","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/4328.77d1c89d.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.800Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/4328.77d1c89d.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css\r\ncontent-length: 6082\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:07 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ra7Io%2FbOoLHKwJttSH6%2FzTzjFgs3ez%2FaqdTNl6qkJGWy%2B1TBo20KNlHsaP6IMLJbDam6KfSINly3aLiyRi2SLmzJzXL4R2cPxv1IyMkPXnjClnulLJ0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e8489d93b8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39284,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"f91fd1f0b580e4ce89eba2f59b019a46","sha1":"6ecbbe670f6ffbf1ed9978b25e473c0d9044bd4c","sha256":"0a2b1b0dc0cc462a94925cfc501f7c570bb1f1e6a7572043c368fd705b73abf9","sha512":"8651da2aea29e1d6c5b9761e882c5a6ffd2c209fef57dbeff10ba4b9dfd73cddab9c2d97b45eb0b05ee9410248da32fb5bd6007bfa1d2f38394acc801cdfde0a","ssdeep":"384:WHB3Ff6KRTmPgwEHCpSqTq+Y1KixzxfxLkLUW3og3j5aFdwEHCpSqTq+1GgWPAvC:WHB3hi9qh7AjRINi9q3pwa","tlshash":"6803856a8521194e1a337be9dbef1978db00545367c209e47dcca98f6f702b8e441fac","first_seen":"2026-01-03T19:33:29.76952Z","last_seen":"2026-07-23T22:44:16.950618Z","times_seen":10,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/css/animate.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.979Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/css/animate.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 4929\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:10 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x%2Bq0TUtQgYDvOttb%2BQyHsLER8Ao%2Bom8heh1qiTDR8hdzeBmpQhvjNEsXOHg%2FBFBX%2FE9St7NCbjSFAbygN6Cdwwrgrtx44uH4f%2BABW8dmhpzmLk%2FbIjY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a8b498deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":79279,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"1120579032f3cb1737e0819f9fcffa7c","sha1":"3981684171cebe7deeafb9d7a4a54bbad43eedd0","sha256":"bdf63257624aa701af1476c0a25c86ec555d9ccdec0a0157ed005a49d5423856","sha512":"58cc41512a92a327fef08ee58716d97e0b8ba1f93df13912ae666da83ebca50d612cd5280367fbce00b0e5a04ccef9a167ac74bf4ccf6bab47e348bf631aed9c","ssdeep":"1536:gBDxYx8x6xu899Ml5Ixxx/xGxW3BkEiH06GdX3aKMyt2MNal:0xYx8x6xVxxx/xGxUK","tlshash":"4d73389d9b4015c457328d2a8bcd4e64463cb973587a5cef7282188fdfcab9c63ca607","first_seen":"2025-01-22T15:28:39.254573Z","last_seen":"2026-05-13T19:15:32.232083Z","times_seen":13,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pro.edgeonetech.workers.dev/?v=https://cdn.midasbuy.com/oversea_web/static/js/main.8f2b2f27.bundle.js","fqdn":"pro.edgeonetech.workers.dev","domain":"edgeonetech.workers.dev","tld":"workers.dev"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.055Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"edgeonetech.workers.dev","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 09 Dec 2025 03:54:13 GMT","end":"Mon, 09 Mar 2026 04:52:54 GMT"},"fingerprint":{"sha1":"F4:B2:62:FB:D2:D4:1E:2A:1E:50:BD:8D:39:B6:F9:40:95:DB:46:12","sha256":"9F:03:DA:8F:5F:BB:ED:ED:4E:60:40:13:20:94:04:33:9F:BB:5F:E6:43:E3:5C:1A:69:94:B7:FB:BD:7F:99:14"}}},"request":{"raw":"GET /?v=https://cdn.midasbuy.com/oversea_web/static/js/main.8f2b2f27.bundle.js HTTP/1.1\r\nHost: pro.edgeonetech.workers.dev\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nreferrer-policy: same-origin\r\nx-frame-options: SAMEORIGIN\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kkbS0qBo%2Fu3No5ixQuR8qiJRQ9qbfhS0TcNK1UMRT0pWfGpY3awneVj38EOKSYyQ6x1JpIIybD%2FFgVFBUcsGYx7zd22KF1KPwWgc9ueabTQP%2Fpl6wTl5Rhg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\nserver: cloudflare\r\ncf-ray: 9c0e848bc8495694-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-26T23:51:00.35555Z","times_seen":17552102,"resource_available":true,"data":null}},"time_used":169,"timings":{"blocked":25,"dns":16,"connect":8,"send":0,"wait":13,"receive":0,"ssl":96},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/c1e8cfdb317c02f0892c59027811a97e.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.285Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/c1e8cfdb317c02f0892c59027811a97e.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 08:38:19 GMT\r\netag: \"a5e078ed46cf0c3027950fb7f5ad62ed\"\r\ncontent-type: image/png\r\ndate: Fri, 10 Oct 2025 02:39:42 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 10577499968579057018\r\nx-cos-request-id: NjhlODcxZWVfOTE3NWI3MDlfODgzNF8xOWRmMWQzZg==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NTk0MDk4NjY0MTU\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3920\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 17105499898813908534\r\nx-cache-lookup: Cache Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3920,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 96x64, components 3","md5":"a5e078ed46cf0c3027950fb7f5ad62ed","sha1":"0e24822ced161ee4e8467008565250880032cbbf","sha256":"892bf5c3feb460f2a3f62e3bf7f912738ab3ac59f4b7172cf5795332e39b67d1","sha512":"b9054b711bfda15423543aa7319729f466741bc2b7ea8d13c07f7f75b0906c6b841141881b39829f5b3489371a0f630c77564cd45b30e8dbf5b54bc6bff5ce6e","ssdeep":"","tlshash":"59811717e1b23b52ee98c47735fac00f1a2d59d025c56508b8ffd1aa17b44f81b6a0db","first_seen":"2024-10-30T20:47:39.142108Z","last_seen":"2026-07-19T01:02:47.559366Z","times_seen":44,"resource_available":false,"data":null}},"time_used":758,"timings":{"blocked":746,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/5dc29c6aed47ec3720c283738821ffce.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.321Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/5dc29c6aed47ec3720c283738821ffce.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"7806da70aeac080017ff00ccb132f2a6\"\r\ncontent-type: image/png\r\ndate: Thu, 26 Oct 2023 09:34:02 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 14132467261481362850\r\nx-cos-request-id: NjUzYTMyOGFfMzQ5MDI4MDlfMTJhZjFfMjBhNTBmMA==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDgxMzMxNzU\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3578\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 7880143701782046602\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3578,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"7806da70aeac080017ff00ccb132f2a6","sha1":"8443ced94e2de0bba00e48dd05008119dc0c435f","sha256":"0f2902e79394b80957cc01d3abf9cc2263531356f8e1807d0fe8b9f6d98d52d9","sha512":"4e5e9dadec2f97632b2777bab684e063caae6db452056b9362b4be8bb984bbc690aca5ccc7b1f3c21c408d13ca359debb068e80560d2e17312c01789aee9b22f","ssdeep":"","tlshash":"43717cfa7993d69e803f402c2bbded5866b04669a0cc77fcd608e00b454957d88ee642","first_seen":"2025-01-22T15:28:39.184949Z","last_seen":"2026-07-19T01:02:47.487344Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1501,"timings":{"blocked":710,"dns":0,"connect":0,"send":0,"wait":789,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/zone/349.85fa8586.chunk.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/zone/349.85fa8586.chunk.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:00 GMT\r\ncontent-type: text/css\r\ncontent-length: 5643\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:07 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2FSueAJQ2ExCguqH0OgvyvwQ%2FlihYgfNFEYGxI%2BQAPCE1WQoX5UrXuBYGCtZYgktt%2FfXckvN%2BtuHBEO12TocsJNkUXJ8o%2FFDLPupZU1R2RprK8YKo5lg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e8489f9aa8deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24726,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4040), with CRLF line terminators","md5":"c088139ea3eff085df76e6da551d28ba","sha1":"8de5b30d2674890d00655012bbd7b6cadf4944d2","sha256":"b4a8fd223a6f6462c156b295b765e470e380e34851ad7f094db56087e96b77ef","sha512":"350c06410a8086b00b118a46f3e15436f0a24981771e6399265344da110b13a697f3b627141fb5802e64cbfca7cbf8800ce51f8b1cc6eeaf7602285583597665","ssdeep":"384:Polb3AKEQciiwELt0aJdzSoOMhwEHCpSqTq+Ys2:OcKEQciizSoOMXi9q1s2","tlshash":"d6b260358931ed8622339f70dfd6428cef28a41357821168bdce52988fb01b8b361f6d","first_seen":"2026-01-03T19:33:29.789055Z","last_seen":"2026-07-23T22:44:16.928436Z","times_seen":10,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":227,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"site-assets.fontawesome.com/releases/v6.1.1/css/all.css","fqdn":"site-assets.fontawesome.com","domain":"fontawesome.com","tld":"com"},"ip":{"addr":"104.18.40.68","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fontawesome.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 19 Dec 2025 21:28:44 GMT","end":"Thu, 19 Mar 2026 22:28:40 GMT"},"fingerprint":{"sha1":"87:09:C0:02:92:4C:46:4B:44:24:E8:82:D9:66:67:19:1E:B7:36:86","sha256":"4D:6C:5D:B0:58:E0:25:6E:02:7C:52:F9:DB:54:71:C6:EC:6F:60:D2:DE:87:67:6C:31:2D:09:E5:90:3C:58:E6"}}},"request":{"raw":"GET /releases/v6.1.1/css/all.css HTTP/1.1\r\nHost: site-assets.fontawesome.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-encoding: gzip\r\nx-amz-id-2: r/KWOTsDV3PhSvZOIYtorsobd6X8PLOhQH36+6DQBiMVj9vuhB0eyOUsEaLGMk8iY6gc1ZpI8nghf4BMQkOF8W+9ggo8Cgy3gSP+lixP/p8=\r\nx-amz-request-id: A1X92DS9AYWCFMPQ\r\nlast-modified: Tue, 22 Mar 2022 15:39:41 GMT\r\netag: W/\"325672b036bab9b57f6873aed5eccc43\"\r\ncache-control: public, max-age=31556926\r\ncf-cache-status: HIT\r\nage: 544810\r\nexpires: Wed, 20 Jan 2027 18:07:47 GMT\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\ncf-ray: 9c0e848b6a84b518-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":498160,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65360)","md5":"325672b036bab9b57f6873aed5eccc43","sha1":"264f5db348311950380ad1bca79754ff593d87e2","sha256":"a35f901d01118e5649091bd03ac5784a7db52e111fb3806524c412f3d1dcfc5d","sha512":"50a041c49e4ddff318892b184e512c011b29e2f10b295448925103e0c6fac29b9514e832e4196dfac5d4773d530d17aa5ac9bae31c41036428049442c48d31e5","ssdeep":"3072:/r3CYP5vO+mDFwFyiFCIUMZ+sEx06eJls0ugtMHxx3/to4hQQ/:jCYVhmDeFyzPG6eJl9tMHD/toU","tlshash":"65b4e8a0a05520dcb3d7e60f5b02b629e4b3f33ed9814f5fe1d5484e0dd3a6871867aa","first_seen":"2023-04-05T03:57:11Z","last_seen":"2026-07-26T16:32:28.398936Z","times_seen":6764,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":58,"dns":39,"connect":4,"send":0,"wait":33,"receive":0,"ssl":87},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/css/link.css","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:00.994Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/css/link.css HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: text/css\r\ncontent-length: 1132\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:10 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=2,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QpH%2Fnmppvnk7qbQKugRIGyFsTfaWI4AspIFgtj%2BUv2dbrKRBkfgFeIRVNQr6CSnteSt3u%2BNKrD4oOZlUcXNLQe17aY4Apirn05EW6oowIHHccKvL0BA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848a9b598deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":5918,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"b6503d3266f8e98ba08dc7d473d32a51","sha1":"37296ba91057307deff523337a89e819f6c2abb4","sha256":"2aff1a358bdb843cef1cc144f400956a9934a9c7d98107382925e9c862614b2e","sha512":"e601b98497c968c3fc8b391e598f10ccc6ef095d8e19ada8a2e3b4b53dccee7a29550926561f6c8f331f04ff023ca793fcf962342d535cc369c3fd1de195b77c","ssdeep":"96:uX3dyH7T1dKOLIDsyIDpIDlISwIDxYBZlqf6J90JqmEFtOUFkJt:kNg7BrosE6300VFtnFkJt","tlshash":"4ac1ff233b111c49f006dcd9fb5abf69a70f6423964f8e67f990791ccec51a403a2a8d","first_seen":"2026-01-03T19:33:29.7983Z","last_seen":"2026-07-19T01:02:47.495191Z","times_seen":17,"resource_available":false,"data":null}},"time_used":195,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":195,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"i.imgur.com/QRWAJCL.png","fqdn":"i.imgur.com","domain":"imgur.com","tld":"com"},"ip":{"addr":"199.232.196.193","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.imgur.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Wed, 29 Jan 2025 00:00:00 GMT","end":"Sat, 14 Feb 2026 23:59:59 GMT"},"fingerprint":{"sha1":"E4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D","sha256":"B2:9B:23:54:25:04:8F:9E:C6:BC:84:54:20:8B:AB:34:8C:F1:7E:8A:57:AD:55:F3:C9:40:C3:4E:8B:E5:30:6F"}}},"request":{"raw":"GET /QRWAJCL.png HTTP/1.1\r\nHost: i.imgur.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\nlast-modified: Sun, 19 Oct 2025 12:15:40 GMT\r\netag: \"1438425acde368eac5f6e8990c3c79f9\"\r\nx-amz-server-side-encryption: AES256\r\nx-amz-cf-pop: IAD89-P1\r\nx-amz-cf-id: Q9y5ePTxQ-wvwqG19M33NT3dfXHvW_BtKQIFyQoXaxOydva_hZby7w==\r\ncache-control: public, max-age=31536000\r\naccept-ranges: bytes\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\nage: 1117853\r\nx-served-by: cache-iad-kiad7000042-IAD, cache-hel1410023-HEL\r\nx-cache: Miss from cloudfront, MISS, HIT\r\nx-cache-hits: 0, 449\r\nx-timer: S1768911541.115212,VS0,VE0\r\nstrict-transport-security: max-age=300\r\naccess-control-allow-methods: GET, OPTIONS\r\naccess-control-allow-origin: *\r\nserver: cat factory 1.0\r\nx-content-type-options: nosniff\r\ncontent-length: 2693\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":2693,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"1438425acde368eac5f6e8990c3c79f9","sha1":"b7b843340ab9d29a2b8c65a641af92207e955f28","sha256":"ec58640d433b0d684c4ecad5c1176891e718a2272f8399b6bce017a3bd1747d4","sha512":"e6d5d047d765d9cd32d88c5ace66138edddff62dcd187bb98eefaf27c43feebd6ed03d2939f8c605e0db3920d54727031773819a1727257b316276fb0db78f2a","ssdeep":"","tlshash":"90512c2d52c7a53331d2fb2f831ecbc81c53655679a660a29c0f366b63d3295ae40d29","first_seen":"2025-12-13T04:44:10.8121Z","last_seen":"2026-06-09T03:21:52.027218Z","times_seen":17,"resource_available":false,"data":null}},"time_used":22,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/f644d93a5ba145300f682e0e30f9a7c8.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/f644d93a5ba145300f682e0e30f9a7c8.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:22 GMT\r\netag: \"37824cbe67c3be351a2e81a107fc97f1\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:21:20 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 3570808186415317985\r\nx-cos-request-id: NjZmNDFjNjBfZWUzNjEzMGJfZDUxMV83YzBiOWZm\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDczMzUzMzc\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 2942\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 2958715681141423030\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":2942,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"37824cbe67c3be351a2e81a107fc97f1","sha1":"b9bdb630acd767c5bc002fa0bb163c0c59624088","sha256":"62e76c8c8e23ebc81dbc6b790f68d9c70ba9464b77cdb0aebcf3da2a09302654","sha512":"0c3fe85542477d8647e71a1cfbab68b0355c2ab079157300210f04992748e5445834db9391a4c3f5aeb141b2c1b9f2530f854eadbcbf6b3411ff8e001ffe15b5","ssdeep":"","tlshash":"7d517da1b3bcff2309e1968ce2db0befe63ae601272159151a4d4420e31101e019f57a","first_seen":"2024-10-30T20:47:39.037984Z","last_seen":"2026-07-19T01:02:47.548959Z","times_seen":17,"resource_available":false,"data":null}},"time_used":1644,"timings":{"blocked":854,"dns":0,"connect":0,"send":0,"wait":789,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"udgqcvkk.fortoday.asia/WyWm6122/img/popup-close2.png","fqdn":"udgqcvkk.fortoday.asia","domain":"fortoday.asia","tld":"asia"},"ip":{"addr":"188.114.96.1","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.544Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fortoday.asia","organization":""},"issuer":{"commonName":"Cloudflare TLS Issuing ECC CA 3","organization":"SSL Corporation"},"validity":{"start":"Mon, 24 Nov 2025 01:11:44 GMT","end":"Sun, 22 Feb 2026 01:20:17 GMT"},"fingerprint":{"sha1":"9A:F8:78:77:E6:33:EF:66:72:6D:D1:9A:3B:8E:42:F1:DA:F7:6B:9A","sha256":"86:0A:3A:CC:1F:D0:78:4C:00:CD:A2:16:0D:C7:C2:61:E1:75:8F:C1:EA:85:B1:88:12:90:8F:56:BF:0C:6A:E3"}}},"request":{"raw":"GET /WyWm6122/img/popup-close2.png HTTP/1.1\r\nHost: udgqcvkk.fortoday.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/WyWm6122/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 20 Jan 2026 12:19:01 GMT\r\ncontent-type: image/png\r\ncontent-length: 358\r\ncache-control: public, max-age=604800\r\nexpires: Wed, 21 Jan 2026 16:55:52 GMT\r\nlast-modified: Fri, 26 Dec 2025 09:51:32 GMT\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\npriority: u=4,i=?0\r\ncf-cache-status: HIT\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MB1pItZBrX8cxNOFzjntAK1grGQcd04ht%2BVT0gz6RfkFLOt5Hodk1R9kbL1ZTG7jnzfu6euvcTVzFimuoW%2FcW47AwvhCYjxidndvNv5H2l0op2m8szQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0e848c2fe78deb-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":358,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 30 x 31, 8-bit colormap, non-interlaced","md5":"14f983708ddeb2052c1756e3d79f7031","sha1":"56d439d66495faa3a784b161d044f6edb853f8ac","sha256":"47b6e3288d9def65b44f0ac0ea8a5e45cc77aa1b934b85aab003cd9076e1ab1c","sha512":"b5a24dd03566529fa2488801cbaa125fd3b2ad9e4806bfa60af5de0c36550d65a6e902cd444f03ea161ed8350cdfaec376e29b53d702cb8025013e8072445fc9","ssdeep":"","tlshash":"43e060818cdafdfc872dc8f2c3ba68d83808a8211708008b40c49d3ecdbd0428121f80","first_seen":"2024-03-01T19:08:45Z","last_seen":"2026-06-09T13:25:30.742902Z","times_seen":164,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-01-20","alert":"Phishing Block","trigger":"udgqcvkk.fortoday.asia","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-20","alert":"Sinkholed","trigger":"udgqcvkk.fortoday.asia","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/6426273c411d56dea83b843208fc0956.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.187Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/6426273c411d56dea83b843208fc0956.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Wed, 20 Sep 2023 04:03:05 GMT\r\netag: \"de2290f1fd7a40307e91850dc7523c0f\"\r\ncontent-type: image/png\r\ndate: Fri, 10 Oct 2025 06:22:43 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 13225242165171071254\r\nx-cos-request-id: NjhlOGE2MzNfNTY4ZjdjMWVfMzE5NGRfMTlkNmFlMTA=\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNDg4OTExMjQwODI1MzY\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 7415\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 6214613017133046010\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":7415,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"de2290f1fd7a40307e91850dc7523c0f","sha1":"158e774068e54827713281d58df848eacddfa610","sha256":"275fd1c5a87f312d9c702467667fd5bbbc8c01ebc897a5d2712450d40755fac0","sha512":"f527fbf5d2c6173e6f536c216ebea9e0f9069d9918a9a03a391478c51d3ac6dd18049bafcf1a890ea563a32fd34741eb1a86bb61bdac9b260cb6ac271bb81afd","ssdeep":"192:S1QGd9BmU9HynuwoadVVJY9nMl3j/KrjImK:hQmq9C/Vwo3ojIP","tlshash":"74e1aee4a9806e1c8ce0777f3633b46fe6f42ebbb51791014009ba997d82cec1429c0b","first_seen":"2024-10-30T20:47:39.06474Z","last_seen":"2026-07-19T01:02:47.554857Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1646,"timings":{"blocked":629,"dns":0,"connect":7,"send":0,"wait":761,"receive":1,"ssl":246},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.harvestsharp.com/images/midaspay_channel_icon/2ea90a3caa3f65115931aab51dd00cb5.png","fqdn":"cdn.harvestsharp.com","domain":"harvestsharp.com","tld":"com"},"ip":{"addr":"43.152.140.79","port":443,"asn":139341,"as":"ACE","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://udgqcvkk.fortoday.asia/WyWm6122/","date":"2026-01-20T12:19:01.313Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"*.harvestsharp.com","organization":"CENTAURI DYNAMIC PTE. LTD"},"issuer":{"commonName":"DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1","organization":"DigiCert, Inc."},"validity":{"start":"Mon, 01 Sep 2025 00:00:00 GMT","end":"Mon, 31 Aug 2026 23:59:59 GMT"},"fingerprint":{"sha1":"02:6B:1F:32:B3:B2:6F:A4:25:AC:1C:E3:87:90:E7:4A:78:36:9F:BE","sha256":"EA:E9:7E:E4:22:E2:21:19:4A:C6:3B:27:29:3C:BE:BE:35:A4:A6:F4:0B:C6:AA:9E:C6:EF:BC:30:7D:58:11:67"}}},"request":{"raw":"GET /images/midaspay_channel_icon/2ea90a3caa3f65115931aab51dd00cb5.png HTTP/1.1\r\nHost: cdn.harvestsharp.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://udgqcvkk.fortoday.asia/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Fri, 30 Jun 2023 11:59:21 GMT\r\netag: \"82d0111247fcd06961845307b01a568f\"\r\ncontent-type: image/png\r\ndate: Wed, 25 Sep 2024 14:15:23 GMT\r\nserver: tencent-cos\r\nx-cos-hash-crc64ecma: 5542716294732801677\r\nx-cos-request-id: NjZmNDFhZmJfZDVhZTRkMGJfMTRiYzZfN2I1M2MyMQ==\r\nx-cos-storage-class: MAZ_STANDARD\r\nx-cos-version-id: MTg0NDUwNTU5NDczNDgxNTYwMjE\r\nx-cosindex-replication-status: Complete\r\ncontent-length: 3424\r\naccept-ranges: bytes\r\nx-nws-log-uuid: 4623455860671664035\r\nx-cache-lookup: Cache Refresh Hit\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS\r\naccess-control-max-age: 86400\r\naccess-control-expose-headers: Origin,DNT,Accept,X-Mx-ReqToken,STAFF_NAME,Authorization,x-request-id,X-Request-Id,X-MVS-CSRF-TOKEN,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":3424,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 64, 8-bit/color RGBA, non-interlaced","md5":"82d0111247fcd06961845307b01a568f","sha1":"7d51c376b87fc19fdf4934b1c751b6c179734d56","sha256":"3ff47a5e812df9768d1468fcabf2b74127f5f67a18c46ba917fd5fd96c5f8cab","sha512":"56c7ab6db5b8be78add66604388ff33e059b4365b320e74988362085b2464f3d7b06ba03c8c61e5540010cfad7c142f0ad3a4b3ef9f61539692808f73a4d3e02","ssdeep":"","tlshash":"ee613b7fdb5a686fcad0b5b943913de102857a65303b0414ee27444994ef38ccd9651f","first_seen":"2024-10-30T20:47:39.033258Z","last_seen":"2026-07-19T01:02:47.443082Z","times_seen":19,"resource_available":false,"data":null}},"time_used":1490,"timings":{"blocked":718,"dns":0,"connect":0,"send":0,"wait":771,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}