{"report_id":"5a5ce6f0-5170-4aef-a2c2-87f4eae202e4","version":6,"status":"done","tags":[],"date":"2025-12-19T18:53:41Z","url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":0,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"title":"welcome-BET365","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T02:51:57.151416Z","times_seen":17879698,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":0,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-23T18:53:41Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"f214n.xyz","ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-12-14","domain_rank":0,"first_seen":"2025-12-19T18:53:47.072104Z","last_seen":"2025-12-19T18:53:47.072104Z","alert_count":797,"request_count":133,"received_data":19128512,"sent_data":68870,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"photo.365live88.com","ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"domain_registered":"2022-08-16","domain_rank":0,"first_seen":"2025-11-02T03:06:46.95373Z","last_seen":"2025-12-15T14:43:33.510538Z","alert_count":0,"request_count":68,"received_data":2956010,"sent_data":32572,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"img.esportsdata.cc","ip":{"addr":"104.26.2.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2023-06-01","domain_rank":0,"first_seen":"2023-07-06T16:47:53Z","last_seen":"2025-12-13T03:14:06.104903Z","alert_count":0,"request_count":2,"received_data":215617,"sent_data":952,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"9c81c3beaf90f98ca844465a7002e3f9","sha1":"6ddbbdc0cd6b49c92e369b53a70c0ce79e64e086","sha256":"36b56b4bb4fa9bad85b500d256518422d24b33749d33d98e70faae4026d27cd8","sha512":"a8a005f93401fd5cf3728852fff090519833c71539000aa3e63732878b6daf16ad01ae2a4eb5a1e1dae7afde4af219abbfdac27710c2d972d8a5640c56f2f71c","ssdeep":"","tlshash":"24217b195ee698211033703a1b5bf3443435c01b719dde013b5cc394af2896ba972ad5","size":1203,"data":"","first_seen":"2025-08-09T20:01:20.302285Z","last_seen":"2025-12-29T13:58:58.092967Z","times_seen":726,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/31098.1756903329400.4108b3dd.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"215815c091a19829f9fd6e5f28039f0a","sha1":"8ff2707b0ab4498bfd2bb7f99674b5a245ecceee","sha256":"06371440853645a0532df5edbbfd5c9e9661bec969aabc25b3353297c6f6574a","sha512":"34933b0388cddca0826af79fdd0f82c31c1264e87f004cd921360b19dc83a0ff188ac52a4de89427cc1c09f2785179fdf4d0ff7526d4a74a55f7971fa2738e9c","ssdeep":"1536:Ow+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsf:O/KK5sY4brG7O3SnLJNpL","tlshash":"1574b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec96c446aaf8865e91857245c4da","size":352758,"data":"","first_seen":"2025-09-04T00:49:32.813984Z","last_seen":"2025-12-29T13:58:58.029423Z","times_seen":409,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/configPage.js?v=9/3/2025,%2020:46:11","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","size":949,"data":"","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-08-10T17:58:48.47216Z","times_seen":2885,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"5281f83487c386b7836c0a61310eee71","sha1":"b69aa5eb7750fa2d18540f7a8f28dab10d4b2631","sha256":"5c4f27503b020517fa4d8a831ce6ea7c9b425cbda5603e8e6ce9119aa406cea4","sha512":"4d7ca7094121bc51fd7e24de7f2b9218624f1c7c2b5949e25ad2be53f4b1babc0ac6265a9e20acd2d51fec4e844baebdd7d1aa300a7f52f3b360bf36a8979ca2","ssdeep":"","tlshash":"5c8004047d5d50540000503014740c0d5c133c57403f0314340dcc013fd5c401447441","size":36,"data":"","first_seen":"2025-03-03T20:54:16.013922Z","last_seen":"2026-06-23T09:11:58.933356Z","times_seen":2969,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/17600.1756903329400.89772027.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"537a1190cc025f0707bbb2a736630283","sha1":"1ac2e221c5e4e26737c6e1b7fddf2d363e4b65c3","sha256":"296f9d35557dc9588e8c6bed7134ca0e3055473306531756660582a6886bfedb","sha512":"3202114c8afb764ea0c4cd32bd78e7ad51295face85601b71b7316535d8fc29ecfb314bc1ace4ff0f54ef46a2016d09e764078ea1d7bd08ae75077ad6eab2341","ssdeep":"1536:+D5AxGst7xILpT0iiRs1vE/yKLJdLI065veGiHjLFIEfma5/xY8SbF9JiNp/QQbU:+DqxNfns1v4yKMpBesDz7+I1ou","tlshash":"d8e32a94b380717887a743b5b21f5196d22a08601098bca4f26eed94bf749ddf63ecdc","size":152171,"data":"","first_seen":"2025-09-04T00:49:32.979776Z","last_seen":"2025-12-29T13:58:58.065817Z","times_seen":421,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"49bea4e1330b9d3f17c1c143ce23cb3e","sha1":"3a8874032b5979ba1fadfe141c0ebf28baa32fc7","sha256":"07f2a8f457d336c5a0cb2267f53a4be2676d30140da225305675f4b3957eb68c","sha512":"9cf0ea9cec23fb496db40aae14fe1df1a305d4a847e23a724645052c742a5995250f9d7f3f0584d3226aa17c6af04201f72cf7fca01bf4c788df2ab4cf488ad0","ssdeep":"","tlshash":"b580040cdc5544570000501014500cc57c170417453f435f750c04451fd34700007c40","size":36,"data":"","first_seen":"2023-03-08T15:23:49Z","last_seen":"2026-06-23T09:11:58.930085Z","times_seen":3036,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/index-399e2569.1756903329400.c784c4ca.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"6117cdb5accd41ccb0125c70452306f1","sha1":"80f85cd8a495c476087fa382198b2a06f5d309ae","sha256":"794e522144c7d6885ba07f4654bbf62f0b06f1b985a897645092cdf029afcfea","sha512":"1737016527bd862c7804e4dd164e109c7f3a087b5c0a751764c22f8b2fa9a10f4fddb8f98234d4da33eaf7a314648d28eed89c0750dabf2006ee105b6f8a2cc8","ssdeep":"384:EZSANHLDaxKalO7PT/Wy4QfHhwrxrjgIhK47ZyQQvXTcdw5F3oWf0Af/nqxtU8X:HYDaxKUO7LZ4QvhwVEMKUZpe5FYxAfPQ","tlshash":"c6b2c6e63392bda4c24f9276f33a58ecc53f9241c30fc4f8d265bdd47da8644a992684","size":23421,"data":"","first_seen":"2025-09-04T00:49:32.717031Z","last_seen":"2025-12-29T13:58:58.089613Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"0ce02dcf11f1634908b4afc4e1bcc632","sha1":"f8911bd806c6ddd3daab7f3eba10081d7af38f74","sha256":"46c7be5f428c72dac25551dbcf74f494989a3cf773ff04f9e115e15ad7dc2893","sha512":"c4f56e0a143f096a106956d55a60f07405a2418d8eec9917a027d0ede74e7119884002051c598445519ff87ad5526d035c221bbcfc65ce817539e6162f157ac3","ssdeep":"","tlshash":"1901735d483748107b2225bd537f5045f1a2516f9e87cc103c1e5b00eff48a72591bd9","size":750,"data":"","first_seen":"2025-08-16T16:35:14.594808Z","last_seen":"2026-06-23T09:11:58.933867Z","times_seen":2561,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/64906.1756903329400.e9e9ec75.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"18789db02e1943b9b6e2a4bc1db4cc9e","sha1":"ab3db8b123be3580e4d5198c5ca7b99e0cd00d4a","sha256":"381bb6518856ad825c2e3fa1ec233fefa0ef52a11dd2a2dbca840381687dedb3","sha512":"6895a97c1c487d492779c4d0166bcdf0599a8634c8af8c051b573d84f001b730738eb8194f5edb5ca5eebff733289c293cd9889ea0b373330a3d9860cea872ca","ssdeep":"6144:9MhEyLkbLniyyeBHlBfb08rzZAncbtiTisXuLCoSltnIwb/mmtMDj0Rts:9MhEyLk3niyy0HlBfb08rFAncbtiTisY","tlshash":"3b241b94b690b17883bf85ff7224a164e24e1f9860cc9de4d26e2b407f12706b8775ed","size":217749,"data":"","first_seen":"2025-09-04T00:49:32.707517Z","last_seen":"2025-12-29T13:58:58.048456Z","times_seen":418,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/45734.1756903329400.46beea1c.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e5f34b5441b6b582d6d469c537f6f97a","sha1":"defd5aad4e0d066131c97173b21b7b3442cdb951","sha256":"44db08eec9e6d649f62d7d208bce223e33424ebc58c21098181a90ae5a1c6437","sha512":"4096ae8bc07709597c8411157950bea75aba46cee36964fe1e280a31a2c2c9d4a8d5821c3e8a4cca552919511930bc9f834e2054580c452acc17c1011d1e6168","ssdeep":"6144:F/EFTU8Ra90Jjytg7DiQPkcsz1h84faSDWidmVHrqZL:9y/jytgPJP484fa5VHryL","tlshash":"2a441c84b291f0b4879b42f7922b4055a17f48a130ccacb4e2a5ed90be7555c927fbfc","size":277026,"data":"","first_seen":"2025-09-04T00:49:32.926111Z","last_seen":"2025-12-29T13:58:58.062377Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/home.1756903329400.bfa8c420.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"caeef6f42deb46a855ccb60a2ed5b445","sha1":"13594059c305a13f3f001270017ab9aaa21443c2","sha256":"ede9bdf96f357afd7f61662fc1654334932bdf9d3e0ad7e9581a792bf2912530","sha512":"0f28cdf6693505cf9c674caa54a226cb16de87aead1b75244f3c6e68ee5d206b133b3e5f081aa9a1db2b285e8ac607f1a1a289401afb0b6404b3e2865d0d9d03","ssdeep":"3072:f1E8oNSIMrtwsAFJBuokQvFUqlGSBJZhxffj7TEOiGRA3:f1E8oNSIMrtwsANKUFHzffjAGa3","tlshash":"c3040880b5f0e275575fd2bbd7371024b22b1686d0ccac60e1f66b187e18799b236db8","size":186713,"data":"","first_seen":"2025-09-04T00:49:32.93504Z","last_seen":"2025-12-29T13:58:57.964054Z","times_seen":424,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"bc8a294899b949ca9677d96ab1c49745","sha1":"983c5ec164a83ee42e930da5b41946e6b0884dc6","sha256":"1f235d2a99775c3e5208abb2a05db1d9b6da61997a61ca5f7acb6ecb63caab29","sha512":"544b86acb0f595a5b12b887d5270444b63e23af877db68c8bce9ee5c66b37de75648eb9ea0757f899dba25f6376013beb278c9c8f801674f8886ae4368264e6f","ssdeep":"","tlshash":"4551b16d856684711db3346d2b5fb34835b340a36149de113d4d8f802f6895e82a6bea","size":2590,"data":"","first_seen":"2025-08-16T16:35:14.597318Z","last_seen":"2026-04-26T06:01:10.157524Z","times_seen":1785,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d053d2da6a5968d7b648d3f7360092a","sha1":"32ae5713edeb00288a3f8f3c02462a5d0ca9dbb3","sha256":"8896d194e4c39e87f52924073dd2d56b4aaab46fc9f7c56a57534545eef1d7f3","sha512":"01f9b63cd24ab6e0e097637341b78cda657192f98e37a39f0f75548f8fe0180418a86594df76858aee7d514282ac4dfb8263e1729ff325035897b841d09206a3","ssdeep":"","tlshash":"82f0a00e0ee548131963707a4c0f9201203b2513414eea08bffe9bb24f92a688a679cc","size":550,"data":"","first_seen":"2025-03-03T20:54:16.018132Z","last_seen":"2026-06-23T09:11:58.931662Z","times_seen":3033,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/45540.1756903329400.c33043f4.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"000be9e193b9b0e7a8e7e2fc6a908605","sha1":"1f04ee0d0816dcb4a310f1bf9053f36c15561922","sha256":"0968ff07195a9aad5c3f080a919c803c162ccb3bb176330b762c1e4e884e75d0","sha512":"d05ca2e4dbd262beab20be9f7872c1faf4d88129b59234fb2009c9ecc7114341558d7813d701cc5aa54dfa4ec028ab007eeff864ac6bed87a4ed8d42499954cf","ssdeep":"6144:rYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:rYD4wFsYiSAKNH3TY5","tlshash":"2b24e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","size":229352,"data":"","first_seen":"2025-09-04T00:49:32.837166Z","last_seen":"2025-12-29T13:58:58.015173Z","times_seen":439,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/index-a3dad144.1756903329400.268893b8.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e70d98f5d06556fb2df3ec9ecd519e37","sha1":"f15f33973e2498e949a62791b8fa6c7ff03c7a98","sha256":"7c6448354a71dab7081c1a9083e1ef15f7c59ff568fb924930620b4758169df2","sha512":"d225d0cca1709f789e457dd14df16ceda4bf4118d6c8f9db25bb9cbd5f30151e6b23d497ba51761a0eba97686323b0393dcfe43652e832dbaecc97b69bccf802","ssdeep":"6144:G4InKyBbhFOuyKO0VPoJBR58n3inyHpZolRlY1z9f7ZwTl0A+:izc90VPoJBR58n3inyHpH1z9ftM+","tlshash":"d7743b94f76cf1bd874e55be793290a4902c1b41b0c89d58d29e2944ff6b385eeb08bc","size":348653,"data":"","first_seen":"2025-09-04T00:49:32.964012Z","last_seen":"2025-12-29T13:58:57.98751Z","times_seen":435,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/65246.1756903329400.c090be2c.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"9695de283c01f0fadf4795c612b010e2","sha1":"9e9b20c41d8eac731f465f87713f570eee532180","sha256":"82d3d78a522caa25376deb145964490b699e6d2c976ae6cdad15f2c4e57cfc7e","sha512":"5f583070eebf753cebbbad1720360c270ec09391ef530c0efb982a92e03b1a10689136cbb74c005fa386f20111b32a602557c0fdf5e2d716062da09d942e2f6e","ssdeep":"1536:r2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANV1:i+iDYvPo0L8oZzAuMMsTA7mqt9zA4dA1","tlshash":"c773a501f78272384fa7e290220f2026e16d191505ac5bd8f179ffb93ef4954aa7d7b4","size":73516,"data":"","first_seen":"2025-09-04T00:49:32.778143Z","last_seen":"2025-12-29T13:58:58.019409Z","times_seen":420,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"2558541837b83dea0f1c8ac757de88d1","sha1":"73dc5d3a5d36b0d2f64662712b98ed67d38fa7eb","sha256":"c39e91ac138a222cb7b8c2cdd75880822c57543218803e85847fbc402cd58aef","sha512":"6bc2837169d8c2a6fc06110969305fa31b87bbc31cc683d0e95ab2eec28606e623d1e07114f031e73419231c41bee11bd93dc8673f5b548a711aa28921fd9177","ssdeep":"192:KQFwqx5Cvtib5XOQRzlaECoXZTAoV51nsPhwzvBa/id3+36a/E/97g6I52MdobsN:K2VwiYwJvSoVXsp+pa/iZcVk97g6nMu6","tlshash":"1c322a69a6b71bba24673036277f301889b080630319fd957c0ff61e4fe54256297be3","size":11820,"data":"","first_seen":"2025-07-24T23:59:52.586926Z","last_seen":"2025-12-29T13:58:58.105973Z","times_seen":599,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"37cda9c8bd90ed9eff421ef541ce8c9b","sha1":"10e30e7f37c9d3f9047b454674e5bbd39325c17f","sha256":"141be120131ffc192dd677c685472431beaa361d4dd03539f79d814cf1434cbd","sha512":"02044fab2c82a7e34f9c9cd65fec0c8f4dda3b52170d846bb908d40cbc34d719d33b1586be421dbdaf4085c442760a8f1f0db93a5e0a9d3ae7d38d5b8072d106","ssdeep":"","tlshash":"fa11cc5a59e28132aa5b302735bd43887728a023d144cf423dcca955bfa8da5cabf6c4","size":923,"data":"","first_seen":"2025-07-08T00:41:53.041569Z","last_seen":"2025-12-29T13:58:58.107019Z","times_seen":628,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/config/initGeetest4.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4b773fe272ef2f3dc7c7e443cd8a0e98","sha1":"8f81f38f03c362533ba34d119215bf83b7574ed1","sha256":"9bb8b869af3ceacb9261dc2cb9165d2716b150bc35ba9da63dd23674fe0773b0","sha512":"e0539af0bc1ad92c1799b6f5c0c759a68537b8063730bd0577aec9f7cf620d34cd166bd5a15c25d89cad49d80f51938b6072c4aa27d07f010e6aaa83ce6e3c5d","ssdeep":"192:hN3ar8HuCDoNu5dq+ExNiqc4K25MB5VsaiQxta4SScQVy8QRHIqaawzjTki59r8Q:fJe61XHlii5aI2PG4lyUIVKQTwwPlB","tlshash":"2562200d68f750a35553b43c8b9f6014b5388a93041cde41be9ce394af9843d9bbabdc","size":14854,"data":"","first_seen":"2023-12-16T04:09:07Z","last_seen":"2026-07-06T04:48:18.66713Z","times_seen":2858,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/theme.config.a0ea1565.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"81c0ad2c8936f5f90cc4ba2b2e53366e","sha1":"8abbe251b908b7d81c73d8537d9d144d3ded3ff7","sha256":"61e7b259016e16c5f842da901c3b2f8202b73db878acb4366eccc217a4dc0b58","sha512":"f295e613097c68b8cb8d0a2530d07c3e883ffc75fdf6d0cd35c23040f1bb182401671c0f70781b64c97db7a37fe9d6d8163de658aef95ce9327ae0068afec7f8","ssdeep":"1536:D2JREob3mtlIRM4Sb2mc42mnzyJog9Cc0hM:qStlGu1pnz45HX","tlshash":"a1a3bb7ee20c963a6177a9bfb46ce111c12e9c0cab1d5fdef13e10a25710669c831de9","size":106213,"data":"","first_seen":"2025-09-04T00:49:32.985127Z","last_seen":"2025-12-29T13:58:58.024831Z","times_seen":440,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/chunk-common.1756903329400.8e9f70b3.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"1b35e779a9012cf73988d1d4b0d9e5f2","sha1":"c139c75aed4b303657e5a48a1fb036d7fcec6533","sha256":"9231e7c73c53eeebd2a055dc9c7402342f21053dbbbdd257be62eaf29c98fafa","sha512":"53ab4c8aaf4fb2bd81c55c7356348b96d509ee4f2a91869043061c8b6ffac404ce76a6ca57caddd47e94dfa5e821a3e6a85c969cc94675fe8625cf44d689c05d","ssdeep":"1536:6ZVB2bNNcdWUc2UTC6oryXHuLmbErF/G7D1dMI5MHLui7TAN/voVG5glVbGD3tFZ:6ZVBM/TC6yjFecHLui7T4/voVG5agD3t","tlshash":"73f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ada6bf19708a436ca8","size":159516,"data":"","first_seen":"2025-09-04T00:49:32.82259Z","last_seen":"2025-12-29T13:58:58.058135Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/13575.1756903329400.cda1d494.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"60a85822cef01147878bbad7876a1fe8","sha1":"94563a78fcb76c76cce769d2fc4021baf782c844","sha256":"5b0a33a268e1507f5e758833c854e3cda700d19c35357e4a2098263a80da8892","sha512":"c23f2184349d611d1c54c379a0aa29d9564ea4b76b44c049647f0caf9e5b9dfd809c87eb9fa94c58377df9a9540580d0920802784fe9f485380985f36eaa4a5b","ssdeep":"3072:z7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7:sKRBgUPDWCW7","tlshash":"42141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","size":194924,"data":"","first_seen":"2025-09-04T00:49:32.754298Z","last_seen":"2025-12-29T13:58:57.972807Z","times_seen":438,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/52388.1756903329400.521cb32f.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"cdd31eb0b7ccfc1eafcead314123dfda","sha1":"2bd4708c1e30cebc08cdada8ef890baec6ef8622","sha256":"669b207d5cf11b0e229699f6e54104836b252c5398e20c4bb564b89b2525f0a2","sha512":"9c48059df23c4a9632eed22a28d883786e40c593fe3ffddb9144fbca21a45322121e36580084fc642e9058f086d3657d819f5d2b9528a91633aeb2085cd5ff06","ssdeep":"768:f9Vl3u/ffsp3aNWchZ4IIATAJ016fkmD19mprq2xd7QjDv1gyT8CpYCVc5WsNiU:8308O1cq2TlW0","tlshash":"84c20a80d6b4f5fd636ec9ab8a3a8464602637c5b0c8ace095ec6e8c3d4475774788fc","size":27418,"data":"","first_seen":"2025-08-29T11:05:53.257205Z","last_seen":"2025-12-29T13:58:57.988641Z","times_seen":422,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/chunk-svg.1756903329400.5bf5ebac.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f3450cde65c4d0964dcc6d243a1656e","sha1":"ad5b362b491b71dff95398219d8e190c80650865","sha256":"924472178572d451953cbf73efcf577a697b3102176fc17d9ab8c379b6b37bee","sha512":"e8f2350a17821376b71a040626a3d5c58cf5744b22d512fbef45b3246558b0f7001ca4d48d32e34831ec7750e40008f7aef529b4e618c6770bb5e72e4c028cd2","ssdeep":"3072:38nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpU:38nz2uasNxpXPrekK+m36UHsE4pU","tlshash":"7aa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","size":461002,"data":"","first_seen":"2025-09-04T00:49:32.781171Z","last_seen":"2025-12-29T13:58:58.073596Z","times_seen":441,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/chunk-init.1756903329400.f53cb96a.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"daffbf99400a4f119f452d48a10ea62a","sha1":"0ae2d45d2befd0f11ae9373195c409f491a511d9","sha256":"1dcfbbb596d333e200aa1b0e4e282c296f29bfafdee19ff4014fad30a394ae45","sha512":"8e39ce35d7f18deb579cf03330a935e18308541617b1a265e4d7f88480b4d29608598e6d2be86328106fa64c4d707e608f333319bd1e7627df53a0170de079fa","ssdeep":"3072:etwqhOIKENB85doKa/x5wc0dB5/J+UUknCqdnr4QMA/C:HENm5ox2Br+2nCjXz","tlshash":"ea441b98b3d171b846cb53e5622b1035f6ba1ca33098e4f0d219ea547f3168dd52eeec","size":273064,"data":"","first_seen":"2025-09-04T00:49:32.986263Z","last_seen":"2025-12-29T13:58:58.044472Z","times_seen":443,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/home","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-08-14T02:38:09.201635Z","times_seen":91927,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-14T02:19:50.702637Z","times_seen":237687,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/64369.1756903329400.27cb8135.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ce99014ab42559bc99f808a69bf596c2","sha1":"adf52a59aba8080dae7b97585e346f5aa782141f","sha256":"39076e64a0e5facd6f6f3d4db7f7fa71039c87d4a6250298dd4bd3059bfd9863","sha512":"ede23f1e36658737f40782ab61a166f1a2a6f61957524beefc283035c39337325c487d6236975bd97cf44aa91b31ed6985a3416ef561edd5b977ff02fb6b1b54","ssdeep":"3072:cHW7tB4Vgj5tNlxyU5YegxYffj7TEOiG1Zl+DJVkzEcx1nKR:cHW7tBwgttXxyUtffjAG1T+DJVkzEcxE","tlshash":"6cf31bd4f2c070f6475f45f2a22b1075b26f4d92318c98b0e15ba6597f21a48c7abeec","size":158174,"data":"","first_seen":"2025-09-04T00:49:32.946075Z","last_seen":"2025-12-29T13:58:58.086406Z","times_seen":434,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-14T02:48:08.051272Z","times_seen":743136,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/21954.1756903329400.57c97863.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2c9f0777c63b333fc66af020ed0ef8e","sha1":"72714b7bdf899cc87c7399253e37aaa2a2f4487e","sha256":"0a2a1939d88947975b56974be20cb84a9c00f3c94cae6e057836b39aaf6b8c41","sha512":"fc02eb76f16f16c8a7346f72e7ac7ef4a68bca53cc7a5bb9f1e00b43f1bb002ca7847e2804be7d6bfe0713c3466210038acc4d5794bea5bec8f0190135f3e7e0","ssdeep":"768:DBPsaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:DP81R6Ipyk6o","tlshash":"0a132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb9f8","size":41968,"data":"","first_seen":"2025-09-04T00:49:32.704767Z","last_seen":"2025-12-29T13:58:58.045079Z","times_seen":433,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_188684fd-5a0b-43f3-8a6e-b9c558e44ec4.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_188684fd-5a0b-43f3-8a6e-b9c558e44ec4.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 521413\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5hVC6iICdg7XHu16bA%2FnAm4iVrJqmM1mwKmi%2B7InKtxufAs%2BlM1futjc7NJFqBc2%2F5gHxuX1HUq2mhYV07EVQ8OO8afZj256znY2eapb82rxBJE2TSTlwprFgS6M\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"7af0e229cfa55344fcefe8c5dc35c36a\"\r\nLast-Modified: Sat, 06 Dec 2025 06:20:01 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48453\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047af3ee9909d0-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 7C1CFB99-1A03-4D48-8D85-9BF4138ADFC5\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":521413,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"7af0e229cfa55344fcefe8c5dc35c36a","sha1":"50146d77df37307958fd0f7c3829605ff99444ba","sha256":"c1d5a5e57cb937644c9218cc17f9834c9c6a13b97e04b545ea6731102359f803","sha512":"8ac56375a3fe5949283831742e7c82ba38cc8b7e4d054a6eba190afe1ebaa8ad05a06561736abe2698daa7ea69f7bf9e33e2757625f66cf146c532ffd0b664ca","ssdeep":"12288:pJG3X3rmMkQC+czqeH67CCU8GNCaSms+9qo7cFtoCGW:pJG3XbHkQCTegzCuNntqo7o","tlshash":"35b42395d653f0c0a847304fd6ce8abc1e831e4b835bcf3b2e67cc5966669da6da40c1","first_seen":"2025-08-29T11:05:53.306771Z","last_seen":"2025-12-28T02:09:46.265785Z","times_seen":284,"resource_available":false,"data":null}},"time_used":1919,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":637,"receive":1282,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/noData/cms_moren.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/noData/cms_moren.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 19732\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-4d14\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170389=idzLU/VnowglBgoqJE8E87wM7N2x/XjzHcgPl1shS4I1xcQPPmlzEkFuT2xu+AD7F4ZtTRdDfIH9Us1jlpRGvwS2rGSsoDgxnfRyd3GWrGiywCS9NNen0IIc+8Y2KMwSzT/mRYytP7KLkipz1SkQ2QNVsFqqQ7BWDLeOVIU+W/pttwEmcpHTO5VhtAMg9t42\r\nAge: 51798\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: FC532B11-BFAB-4139-AEEF-1C9EB70CBBC3\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19732,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 215 x 214, 8-bit/color RGBA, non-interlaced","md5":"f3c825751a70d4aad8da2ce57f76acf6","sha1":"732da443668abb03a79a70df2d0ea8d801158655","sha256":"c395f4c1941459ef620f6df95fabd39f9ac98e03f6a389886bf224157557ce41","sha512":"a3b3fa2a216c10d331fea4771b916825d0605b94e21ac242d152d7c5e4b984cf3baad7a3fd071dde3432162037514d756cce1a0f699baf3dc98eaf75483c91b0","ssdeep":"384:64pTwcIHFqFpIlD8SqhwFLW/na2PvyQXSOKvOi58KUezsTT5ZOon:67XlROe8WvOAPHQv","tlshash":"a592d0d8abcb6705bb132b43b941a3558e0dfd6a130b9bb131782805ee16151e8d7e3f","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.464564Z","times_seen":2274,"resource_available":false,"data":null}},"time_used":3807,"timings":{"blocked":3506,"dns":0,"connect":0,"send":0,"wait":300,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/home.1756903329400.bfa8c420.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/home.1756903329400.bfa8c420.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2d959\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170385=wZL4fG/IgiVy5fExmMb/Ow0HDd89uzX2ljGOp/NtAhDUJCXdjoxMqpx40PbsYHRtZQcELJzO4Cp+i6Jug5CHfX6PodfeNhGUkRn/X/sabWolXc/0V20gYNvd0jXi6czAjYDEAXiTo6c7jbK5eVDYwKcKZwM61eCf/Q/LgkgdBoQjqSvcWMAHHLi1cdLBTwEK\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 080E90D7-F0DD-4E0D-B41C-9261C23D281F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":186713,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64200), with no line terminators","md5":"caeef6f42deb46a855ccb60a2ed5b445","sha1":"13594059c305a13f3f001270017ab9aaa21443c2","sha256":"ede9bdf96f357afd7f61662fc1654334932bdf9d3e0ad7e9581a792bf2912530","sha512":"0f28cdf6693505cf9c674caa54a226cb16de87aead1b75244f3c6e68ee5d206b133b3e5f081aa9a1db2b285e8ac607f1a1a289401afb0b6404b3e2865d0d9d03","ssdeep":"3072:f1E8oNSIMrtwsAFJBuokQvFUqlGSBJZhxffj7TEOiGRA3:f1E8oNSIMrtwsANKUFHzffjAGa3","tlshash":"c3040880b5f0e275575fd2bbd7371024b22b1686d0ccac60e1f66b187e18799b236db8","first_seen":"2025-09-04T00:49:32.93504Z","last_seen":"2025-12-29T13:58:57.964054Z","times_seen":424,"resource_available":true,"data":null}},"time_used":518,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":486,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://f214n.xyz\r\nXign: FaDHXSE1brjOuParIBHYqSLTABroq0lacFTvwAY1hA/rx+0xS6s9yPKkMiOUJDwZtS0ERiF5VY0cTlykLvN2JxYBjnJyy6/qCC0CKWKiFOfSqQEfKCIaP83Z6yifRpISD5k1307X9oWQZrbzyGMHC4IcgRECbK8sZzMJSrk2O94=\r\ntimestamp: 1766170386704\r\nsign: c3e375i7d4a6u36d\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Fri, 19 Dec 2025 19:03:07 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 2A36A843-ED2A-4AB1-8ED2-6572839AA30A\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6563,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"58a49ad3a052797d55924c6ffa4f2787","sha1":"f65c0ae9ebbf9136a415d678a05ac88d70a8f7c3","sha256":"7dda13815fab209c2e5165c45666b9b678d3943291a98d092472afda90516bf2","sha512":"1bbe421ef525bd4bc2baff7f4ef84acd6b371029aee7d9e5b8fcc900c23e3dadf8aed616c2202987306c6643a876fcca5cb0a18cddb62257a9a3140b25a30d04","ssdeep":"192:V574MX5sJUK+Gm4ZQzX2020pUZfiza1yPFVNWmmvYh4aVNma/9HLVooM:rUMXAUahe2kUZkyyPFVNGvy4ajmglVoD","tlshash":"c11290134204f7c3a1b7cab6ec2148c4398967f6b9e5499ece98e7f6053b242d70d58e","first_seen":"2025-12-19T18:54:13.72248Z","last_seen":"2025-12-19T18:54:13.72248Z","times_seen":1,"resource_available":false,"data":null}},"time_used":480,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":479,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b081a0e67ed54e81b8fa32bdc33de489?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b081a0e67ed54e81b8fa32bdc33de489?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 83004\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5091\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"b081a0e67ed54e81b8fa32bdc33de489\"; filename*=utf-8''b081a0e67ed54e81b8fa32bdc33de489\r\ncontent-md5: hznZ75pn11fMjvZ9EsWPYg==\r\ncontent-transfer-encoding: binary\r\netag: \"FgpB0s9_XPIw-B5eiAAKQ4jw783O\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:31 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 4jtM6NZaq\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 8uQAAADuyRn7rYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":83004,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"8739d9ef9a67d757cc8ef67d12c58f62","sha1":"0a41d2cf7f5cf230f81e5e88000a4388f0efcdce","sha256":"5237c3c0829cedd0e6fc7464b074b628f1f4e89157611232de6e038071888b65","sha512":"43af23ed1fe8c704d00e5d3b5b63ee9a1a1e7f581d36b9f9d6f68c409ab7035a21728179f7334874c768b36285d3f4ea3b665abe3dcc8901053352ff92e6f2cb","ssdeep":"1536:Iy5pA26KX2KCMcxC/yqtqQHX0LBmc0BsJAAAF:Iy5pAvgcxI1X0XesJSF","tlshash":"748312c73e12d259f1b0bfa45910cc79e85eb6f0ea5ff0b5be056081ae8914c6242c76","first_seen":"2025-04-01T11:41:17.923892Z","last_seen":"2026-08-08T07:46:40.077532Z","times_seen":53,"resource_available":false,"data":null}},"time_used":2712,"timings":{"blocked":1332,"dns":0,"connect":0,"send":0,"wait":971,"receive":409,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/configPage.js?v=9/3/2025,%2020:46:11","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /configPage.js?v=9/3/2025,%2020:46:11 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:02 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 949\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:19 GMT\r\nETag: \"68b8389b-3b5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1766170382=fD3dUXvTAvqkKlHn3bIXCn0ldYgCieEWsInrTrUy2OYSNeSM3Ocx74L28Ir9Qu5IZZNTVdLIdSEvgdjLQMGdKY8rAwJgkpF4uDVhyWLRwemAIwfZs+oHw1mOuVEVgwYh/ydxqVefveJNFmABhM/gLFLt+3W80dYlTLRrtHmJoHD8gkh4JbcBxTMn6BGv6EQe\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 8B051EA9-F6F1-47CC-813F-E02D2A36571F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":949,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (917), with no line terminators","md5":"e6aa74bb352ef198ba3e1c9a4b01b014","sha1":"2ea8bd6b5045475a36432f7665a129728e822d9e","sha256":"73828e873c0b6e847b37d78941ca436247471dfc90a12f743964f869f75abd5c","sha512":"2faaf24fdf1e4da637af8e9f82d1778bf061b00752dfca0c8f73432ba236a7b69410a7ad2a73727bc83e6cd631fd6555c3cc0d9d3a5d8a7f81818dd66566011f","ssdeep":"","tlshash":"be117aaf57444dffcf1d7e00a08b0a5ea8bc61d261889d4da8e9cf29e1c99002378978","first_seen":"2025-09-04T00:49:32.949926Z","last_seen":"2026-08-10T17:58:48.47216Z","times_seen":2885,"resource_available":true,"data":null}},"time_used":454,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":454,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /ecb/8f8306425ab46d0221b2c56ef50f72e487d5bb0255ee7333091abb7c08c465094a574c3c12d0e1812241fe43c0d5f0ea88d857f698a4fd081b HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://f214n.xyz\r\nXign: ItjlYsfLZWnVIB4l+FNF+Keb/WSM6VGGH1ertJ/KD1HVOAaeFh5Xjpfrs0dwU70akN9dZLccX8EzPohCVOYQd+z5ekYnaSCiPUUuaB3CVTAfkSg9J06PF5hLOuvYdNCsuLN3nda3U45zPzd3Kz3HoJior7+LTMF8mE3uh8cFyMI=\r\ntimestamp: 1766170386704\r\nsign: 2s2muv5t82t3c1fo\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Fri, 19 Dec 2025 18:58:07 GMT\r\nCache-Control: public, max-age=300, s-maxage=300, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 2389EA47-9ECF-4C57-84C7-1E12857A18D2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34099,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"2a71037f93a37858ffc90e5a3ac98e6f","sha1":"6bd071f67b403656f15b9448b29312c62ced104d","sha256":"fe6939e28ca89c64363e67e576390b43fc665167608ec456fb25fc1a185ee4df","sha512":"983e95ca220d76b6ea59832367619c68d031a7bb5ed37153d8079ebf47e26dc4055a5aaf80ccbf35771d046a545fc06a3eeb7bbbef81aa8dcd6fc33f49516943","ssdeep":"1536:OP4r3zOl6kp5Vn1CirqZym9+OVz58PJT/WPEAY9:64r3iEEDhWZ6wzOhTZ/9","tlshash":"1833d1040741f3f4d1aa64fe2c0319c02516afd6f666fea1d97a86202deb41f638f6d2","first_seen":"2025-12-19T18:54:13.7261Z","last_seen":"2025-12-19T18:54:13.7261Z","times_seen":1,"resource_available":false,"data":null}},"time_used":873,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":872,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d7c67aae13f54df3a7b71354b207e937?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d7c67aae13f54df3a7b71354b207e937?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 135877\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5151\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"d7c67aae13f54df3a7b71354b207e937\"; filename*=utf-8''d7c67aae13f54df3a7b71354b207e937\r\ncontent-md5: 4/IRGTStH4LSwmjRjCxLvg==\r\ncontent-transfer-encoding: binary\r\netag: \"Fktda0K-OvB8biFtd7G_8yNltR7E\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:32 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 6y5PXRaoC\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: rj4AAACWbD3trYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":135877,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 829, 8-bit/color RGBA, non-interlaced","md5":"e3f2111934ad1f82d2c268d18c2c4bbe","sha1":"4b5d6b42be3af07c6e216d77b1bff32365b51ec4","sha256":"63e94f63de9b0d3f93270869e571cf62ccd174398d68be3c9bc4da10ef29f2b4","sha512":"b98fa91e09fa077de6bfbf525ad230fc4a460c36b57cb8824d0bbe76dfd585479d1b53b22f968d50ddfc229caf3be3df1a194384be3ff60f0c98db35c9e07a7f","ssdeep":"3072:QF90l7/81ILaWKv6otnhFnWMoK/eeV4IKouOBVI/jge+/RW:QL0l7/raWKSotnnnoK/epkBO/jglQ","tlshash":"6dd30157cf867d771d9925216b2731a1c4bfc42b7a680f1e8bd0e4661dab781f2b8c80","first_seen":"2023-08-24T20:41:52Z","last_seen":"2026-05-17T14:18:39.392691Z","times_seen":61,"resource_available":false,"data":null}},"time_used":4863,"timings":{"blocked":1465,"dns":634,"connect":262,"send":0,"wait":1200,"receive":723,"ssl":575},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/5cf4000aba154ec68d19a96c9e3324d6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.435Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/5cf4000aba154ec68d19a96c9e3324d6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 24166\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5151\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"5cf4000aba154ec68d19a96c9e3324d6\"; filename*=utf-8''5cf4000aba154ec68d19a96c9e3324d6\r\ncontent-md5: IoHA9tDwzV7vcY6JzRzTMw==\r\ncontent-transfer-encoding: binary\r\netag: \"Frd9fVapQbPh6ZGvY0YcagNHUxRs\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:32 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: pVkcS0HP1\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: boIAAAD0cT3trYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24166,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"2281c0f6d0f0cd5eef718e89cd1cd333","sha1":"b77d7d56a941b3e1e991af63461c6a034753146c","sha256":"25282fa2dcc64333f96f8a7a623523b9eb7ace6da375e72e98c44524edf62feb","sha512":"75dfe1430090071c8b4a4a5f2ef61464b8e897744fdbaab2e14dfbbefea99c699bb21e4d7116ead8df9508b479f0406072efe89b469c6ab57036f852e163c436","ssdeep":"384:ays59d756objHwudyG7iMYl6sJoMlD9Lx6XYYUTQ1/izZGhuDuJArig4IyykbKfR:aHd74objHwk7pY0sWM9iGTQ1KzZGLAr7","tlshash":"cdb2e1ecadb1345910bcbed25259b08190ee7e319c329159f8104f331ede862fdeda92","first_seen":"2023-11-11T13:40:01Z","last_seen":"2026-08-08T07:46:40.08473Z","times_seen":49,"resource_available":false,"data":null}},"time_used":4230,"timings":{"blocked":1367,"dns":633,"connect":269,"send":0,"wait":1295,"receive":189,"ssl":471},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/64906.1756903329400.e9e9ec75.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/64906.1756903329400.e9e9ec75.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-35295\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: FFC06031-D86F-4FDB-99C5-30A363861FD3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":217749,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64884), with no line terminators","md5":"18789db02e1943b9b6e2a4bc1db4cc9e","sha1":"ab3db8b123be3580e4d5198c5ca7b99e0cd00d4a","sha256":"381bb6518856ad825c2e3fa1ec233fefa0ef52a11dd2a2dbca840381687dedb3","sha512":"6895a97c1c487d492779c4d0166bcdf0599a8634c8af8c051b573d84f001b730738eb8194f5edb5ca5eebff733289c293cd9889ea0b373330a3d9860cea872ca","ssdeep":"6144:9MhEyLkbLniyyeBHlBfb08rzZAncbtiTisXuLCoSltnIwb/mmtMDj0Rts:9MhEyLk3niyy0HlBfb08rFAncbtiTisY","tlshash":"3b241b94b690b17883bf85ff7224a164e24e1f9860cc9de4d26e2b407f12706b8775ed","first_seen":"2025-09-04T00:49:32.707517Z","last_seen":"2025-12-29T13:58:58.048456Z","times_seen":418,"resource_available":true,"data":null}},"time_used":1076,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":475,"receive":601,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.592Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_c0a34e2a-97fa-40dc-8123-594806696886.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 20219\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Yr%2FPqoaVQTlq%2F7AaQu2PrW5Zl6qQkrJ3Hxa3%2BcyH%2BV0RYWwBknpU9gvVXm6SYW1ujgx%2BVcd8iETl5y%2Fg2pVjHtRLcRmlki%2F5mtfdyI3WR3q%2Ft2Di62YeJhOeMez%2B\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"7fc7275341b7ffb7fc3c2e44aa37d83b\"\r\nLast-Modified: Tue, 02 Dec 2025 14:08:07 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48476\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a776aa80f2c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170392=LGK72/r9wLEJIr9d+AZ253CWHvbX8ozr9tp9MDldB5G8aPH3awDeFS2j9tUgnWT+6m8qQ6UEfWf72tWsi8ak8uWnSOrnl/zGOdYBljadFyiyDyDS5reeAt3jdpQhVvcane2SD+TGN1ytARChdlRlW1H4WIgzsqNovNrLQsAbv8/tMjhI6GXKOl4yva4aoW7C\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: B993FF96-EEE1-4C09-9EF9-D2E1F41C89E9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20219,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"7fc7275341b7ffb7fc3c2e44aa37d83b","sha1":"065bc30356a5837360c7194171d69da1feeada48","sha256":"58f2ef2554dc2845f5ea9b292b7fbf331543f49b3dcfcfee4353b924d1965663","sha512":"95f1b4c0e5e6060628321d0c6694d443893b1b8aaaf94e3ef05ea703e30003de317586329fcfaaf743d311ff27c2c58baddb7a8242e0de5514a0cf5303980815","ssdeep":"384:cbjBpF/NpKkd89ztdkMcDd2/GiyURwOnogFc5cBmwcbe2osrF:cbjBpFNpbePvcDdYv7ogFCcBm/e2o+","tlshash":"7592df661053129bfccb853eb52e99f0f9f484abd0bc871da6034c561b8e85c1668a9f","first_seen":"2025-08-29T11:05:53.28171Z","last_seen":"2025-12-28T02:09:46.214845Z","times_seen":307,"resource_available":false,"data":null}},"time_used":4040,"timings":{"blocked":3742,"dns":0,"connect":0,"send":0,"wait":297,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:17.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nx-request-source: https://f214n.xyz\r\nXign: bBUgqq+vcZ7GRmj//xy9DLAbbPcN6XgdGe8id41bog8iD0EdkFkyIRU5GtQ9im66b2O4pFMFy0e80oPSo6QUNy/LGhhbFR4dFayLaU2g2G3HunAPbp8MDWY/UXUty6ejy8FQ0wOO3BVQfvi5s4JElyY4sFNbKc3yKuKYSmtdzqQ=\r\ntimestamp: 1766170397904\r\nsign: i4f1m2h5e763f2vv\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:18 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170398=10WadLm1/hjeYbaKZffFsrmFHVCmJgwy0KJSVQyKmC1Rfa5MCy2pxRqO9P88+zchiYmEdhjsP7CaL8V7Rwa6eavifqH72EBAB5uCY4aKQfPqgEVysBWSvyhMStFWlIjRJYx39GcTaZhGZTfEjHDgB2I9bHsQUsqTFptvIZmAEw1w8/1tNVjsPtCat8rvQ/x/\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 9C7F3644-1CC5-4C5A-8AB8-5BFFF2C86732\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19503,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (18747), with no line terminators","md5":"b62744b20485b67a816cfd3678aea26e","sha1":"8b28cbef01aa52358a8a6a44395aa555206bf292","sha256":"055b550ec276f079d01db527a3a24a765885b60c9321d25e21530f509e279d2e","sha512":"f8d7ae0465a47624007d60e3527c504f321026b47e5f14b739b72d26536a9370167b795e3c9fed2b0c41b3203d1de651d9795b525c8a1160983b6c4f6f0c3479","ssdeep":"384:eAPcP0oMzn0CdJ0ZcA0EMTl11urebmA5Hmy4AHz4lfz5SV9oHQffs8kb8/v8831z:eAPcP0oMzn0CdJ0ZcA0EMTl11urebmAl","tlshash":"3d92f05681ed18a52f5c60d25c0e7b4c987eea1b0aaef9d5ed4ece4c30b43fb9204d25","first_seen":"2025-12-19T18:54:13.73044Z","last_seen":"2025-12-19T18:54:13.73044Z","times_seen":1,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":475,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/404943f8cfe248f38b7be24c29483006?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.534Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/404943f8cfe248f38b7be24c29483006?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 34986\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 84179\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"404943f8cfe248f38b7be24c29483006\"; filename*=utf-8''404943f8cfe248f38b7be24c29483006\r\ncontent-md5: u/rL2+Z3BRcsZBTX6cIbWA==\r\ncontent-transfer-encoding: binary\r\netag: \"Froy1sVf6WjDdFu5dMcQjzSGKlX_\"\r\nlast-modified: Sat, 13 Dec 2025 19:03:16 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: HfapNa4eF\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: Yx4AAAALnSYNZoIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34986,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"bbfacbdbe67705172c6414d7e9c21b58","sha1":"ba32d6c55fe968c3745bb974c7108f34862a55ff","sha256":"eca09c086a79bfb31d303e16285588d809251717faaa0d6667b1bc0c7ed9d74e","sha512":"a4d051178607e028816bbb3dc325bc68a62111bcc86978d2763278c90b6d58dbcee5425e153372fdbb36ae0917fe2b60cae80eb611276a62d9c2c867d4056fd2","ssdeep":"768:2Q6IQkdpz8VshR34jnSx8VyzNsURLw43M67GA1+16uRYlhs:hIkdp8VshR34jnSxyuNr3ZKyxu8+","tlshash":"63f2e055f5ca15f31b0b823c6aef462ec40894367378b36116e68031db9896f0eca2b7","first_seen":"2024-12-22T16:23:43.98021Z","last_seen":"2026-08-09T14:01:03.895407Z","times_seen":456,"resource_available":false,"data":null}},"time_used":2714,"timings":{"blocked":1260,"dns":0,"connect":0,"send":0,"wait":1287,"receive":167,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/703a294c40804badb678dbf895ed2cb6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.557Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/703a294c40804badb678dbf895ed2cb6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 14522\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 37075\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"703a294c40804badb678dbf895ed2cb6\"; filename*=utf-8''703a294c40804badb678dbf895ed2cb6\r\ncontent-md5: BaZ3pV78/+mqaDddcP5DkQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FpBnP_rKbnwhHnCrN4r7mXDAxRxL\"\r\nlast-modified: Sat, 13 Dec 2025 19:06:34 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: ITAeI80b0\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: eBgAAABmZGLkkIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14522,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"05a677a55efcffe9aa68375d70fe4391","sha1":"90673ffaca6e7c211e70ab378afb9970c0c51c4b","sha256":"c80feb49824566f798e8f544af93a6edbfe3239639fbf6315566666318d2e6cf","sha512":"0b61bd5394406a43e30d703bf9300c1155953b56b581d5e0b1510ac39edca63b8ff8fcae2102a9efa4ef407175964d12701e9765d9fc976b8f2e182df56b247f","ssdeep":"192:UFQSfXtuevvUK6WPPPSXjNj+d/ClfeZZPFvtNfkgtw0ZZbW9yvweZh0HJaBqEpjp:XiuenU1AC4Nv4xyoIhZqb08M","tlshash":"2962d0dcc40f0ff88e339dfccc59af1418469c342b8195a2456826e2ecacdd8554b6f2","first_seen":"2023-10-21T16:28:24Z","last_seen":"2026-05-01T14:24:54.658071Z","times_seen":195,"resource_available":false,"data":null}},"time_used":2944,"timings":{"blocked":1238,"dns":0,"connect":0,"send":0,"wait":1288,"receive":418,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/no_data.02e9590c.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.852Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /img/no_data.02e9590c.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T02:51:57.151416Z","times_seen":17879698,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/35a8a3869fd64be5830d51874c79f7ed?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.416Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/35a8a3869fd64be5830d51874c79f7ed?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 5877\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 6953\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"35a8a3869fd64be5830d51874c79f7ed\"; filename*=utf-8''35a8a3869fd64be5830d51874c79f7ed\r\ncontent-md5: k+7+2TMuVgNWNNm31ed/aA==\r\ncontent-transfer-encoding: binary\r\netag: \"FggKOUKYdaN1VRXqBiDBSUcqi-7m\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:19 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: KHT3j6y3R\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: wGQAAAAwvrxJrIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5877,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced","md5":"93eefed9332e56035634d9b7d5e77f68","sha1":"080a39429875a3755515ea0620c149472a8beee6","sha256":"0f4b0e782e71b81b4efd71dd3a20ba6cf0ba31da30df1209d8b27b6beb0f34f1","sha512":"ed286633ae469e11fc63d472727891bfeb1289f99cdb141371bee94affe4991febed5954fe5e9e5ba2b3ec2b3237da5b5975a41dedc047e9f6e586367f7065a0","ssdeep":"96:RlR48qFdSWquL+cEmJCQlbbQSYU0OoxP/2ql+5JaAfH1r05qpElKq+CrpWuqBAuK:Rli7SfcEmJ1lbb9UxX2qlEv+QpuXYuqC","tlshash":"03c18debdb8606f2dab187b792c5586388d44538f4bc0880a2c048a176ec0cd51db68e","first_seen":"2025-03-28T18:20:50.030091Z","last_seen":"2026-02-28T13:08:48.612545Z","times_seen":26,"resource_available":false,"data":null}},"time_used":4486,"timings":{"blocked":1638,"dns":643,"connect":245,"send":0,"wait":1042,"receive":165,"ssl":749},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/42cfd66e360746e2a92a31da1a832b3d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.463Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/42cfd66e360746e2a92a31da1a832b3d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:08 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 8652\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2987\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"42cfd66e360746e2a92a31da1a832b3d\"; filename*=utf-8''42cfd66e360746e2a92a31da1a832b3d\r\ncontent-md5: NbRynp5ZjdjdhJGUK1WRIw==\r\ncontent-transfer-encoding: binary\r\netag: \"FscUb9L0fXj0HWtTnOfHiy_tmBxw\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:36 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: sD6pOfWyX\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: NYgAAAD8YeHkr4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":8652,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"35b4729e9e598dd8dd8491942b559123","sha1":"c7146fd2f47d78f41d6b539ce7c78b2fed981c70","sha256":"5bca3f271be5a8b7d62b5f91399008b73727d4e642a0953014ac1cf16405e80c","sha512":"824751bf3083d107870d9fe5f55edd6de33ba65d90f7009815b0c28fec4620c43c4e384d84321287fb8af02db3a255362bbd762924193d956124c12da8ef2ec9","ssdeep":"192:+pSCir0ZtLNKilxk17jDzU2cfYBKLPvxvndN67nJdcE:+mrsLzlxI/DotfTpdMjLx","tlshash":"f402af109f37ef3207424129dc56424c645b1a5b80a956337bfd1c2ed8496e79be36e1","first_seen":"2025-12-19T18:54:13.73546Z","last_seen":"2026-02-15T16:17:35.972224Z","times_seen":13,"resource_available":false,"data":null}},"time_used":2451,"timings":{"blocked":1329,"dns":0,"connect":0,"send":0,"wait":1087,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/23025b42cf424f98b44455916e9cde08?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.502Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/23025b42cf424f98b44455916e9cde08?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 3576\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3168\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"23025b42cf424f98b44455916e9cde08\"; filename*=utf-8''23025b42cf424f98b44455916e9cde08\r\ncontent-md5: 8yHhqgUsL1kAR1OyURR8hA==\r\ncontent-transfer-encoding: binary\r\netag: \"Flsz8zI_mcI--PTcVT9NxuE4cG--\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: jVOu4uYrQ\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 6oEAAADUkP66r4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3576,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 204 x 246, 8-bit colormap, non-interlaced","md5":"f321e1aa052c2f59004753b251147c84","sha1":"5b33f3323f99c23ef8f4dc553f4dc6e138706fbe","sha256":"8fe56b874b0c313e08397afad927683102107a4886293153d5b88079fdd9feb6","sha512":"98804e3a95b98b039eeb3536fd93f5fe7e13bc01d92debf301cb198cfa0605fd122241c27507b03e9a02728119cf0c2a150eefa5ecabc43bf949c6a7688223fb","ssdeep":"","tlshash":"15712ca1830ae54df2306a2673daddb2ec217414ca7be09bf97f050199b0e21b00d496","first_seen":"2025-12-19T18:54:13.73687Z","last_seen":"2026-05-29T16:01:53.070917Z","times_seen":22,"resource_available":false,"data":null}},"time_used":2613,"timings":{"blocked":1292,"dns":0,"connect":0,"send":0,"wait":1281,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/vs.21f89f73.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/vs.21f89f73.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 1306\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-51a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nAge: 51776\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 4574E241-7C28-44E4-95C8-349E54A3B044\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1306,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 70 x 28, 8-bit colormap, non-interlaced","md5":"41cff06a80e61ee3fcd32f7c29a6493e","sha1":"bb70bb0a3a0fde7a132788777aee629392c756e9","sha256":"3240fcea2e4168dc863b8aea602750e6a1fe11a557c18ac6a381781ef487746b","sha512":"fce7ff9f62b51c4f8994f0a8ec4a56f21570d0cd163471d99b357eb0a9a735c800b389c4a8a611ba441b208cea7eb483140042f5d11ef110b591c1c1898bbb8d","ssdeep":"","tlshash":"e921eaffe15b2c75ccb59bb3bc6c12656809582970866b137125e7588c539217f0c461","first_seen":"2025-08-29T11:05:53.184813Z","last_seen":"2026-08-10T17:58:48.487849Z","times_seen":2350,"resource_available":false,"data":null}},"time_used":842,"timings":{"blocked":540,"dns":0,"connect":0,"send":0,"wait":301,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1884x434_8fe89870-1081-42db-97b7-f8272ac29ae0.jpg","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.087Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1884x434_8fe89870-1081-42db-97b7-f8272ac29ae0.jpg HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:11 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=guq8po15m4%2FwbLyfUfZfXXBRbjJfcG25Pu7%2FrFwPlhz1ZYURIWZaBqMo0Yijim2qwJCEAgs%2Fip%2BHOSMfSSartMB1MB4QUJLr9zc1uYLo3fiuRCo%2FM34Bzjwn99VS\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"d04176a6c26e72c117b0f85d0eba80c1\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:13 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 27381\r\ncf-cache-status: HIT\r\nCF-RAY: 9b0919f02966c896-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170391=tUOZ8RdTGViMVT0qRVsHCkEd/bDSrV60ZM36/1fg7dt4ymzJSog+mHM4PBbyfXIj2cVUcwU+RjuOWIEUq07ZLMXkXynq8W+d7yA3jAb0vlIqzxiyuLdsPuMnf0EFrtUwzrvVSH/Y3ArQqqkbbBowjMGG+qwqGfdwYBD3k8xlLq7ltX2p13SyD4ww+LGigZTL\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: D4DF84E0-823C-48B4-BF39-F25F3736A1C7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":344312,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"d04176a6c26e72c117b0f85d0eba80c1","sha1":"7d91bf688b4db4aa7840e7363e4b6477af75a7be","sha256":"e9229d385904201a79e88ec20831ab928bb126770dbb4cfcb1869d0d086083d0","sha512":"7f2d4db766ad2cd9f7b56750aff6bc621d478e79004b13e6c9dd41672d2215f2a817c43ec2ffe7cf46227d92c8b73fc94319be24edc93433c7ccac535e6295d2","ssdeep":"6144:QLznFRjZ8DkK4VAJw9ZFDPGVuiuRpBK9ZnAEpTLpzuJt1wfb1iaPH2kUM:g3Wo3PYuz3q/zqwzdHdb","tlshash":"6b7422e83513ca884b2f8f7b14c42a4d6a8d2e10dceeb5e9b479bd475ec280c867d494","first_seen":"2025-08-29T11:05:53.255926Z","last_seen":"2025-12-29T12:28:25.270141Z","times_seen":343,"resource_available":false,"data":null}},"time_used":3729,"timings":{"blocked":2679,"dns":0,"connect":0,"send":0,"wait":531,"receive":519,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_04beb05f-bdcc-4bf4-a35f-b560e45e45b0.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 108004\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W4mSgjyin%2Fyq%2FK6nc%2Ff1QMwITFluNv1dc5mgkiusaBvufMNdyuhdlr2yKVerVfEnzBLyh8aiBDg%2BsucTbLDr20%2BXwzkvgdEA6CMc3GetBJeGY6pI5RTWADiaztVG\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"a3775875c9308eaccad9d436837da5ce\"\r\nLast-Modified: Wed, 10 Dec 2025 11:53:00 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48460\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047aed1feae2e9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170394=Nz/+pSZmaO2C7uXGVyo7DBMkcXHGCcUuHmaPtLTQSXXLpvwIEjYbRDsDBkLOVqPuf9OO8cBm2gBYUxJ437Y8TlbdnSLR8QRLsz+VHrr7fKeAWVvF5ScDjC1Xk6Vq6nfHSdhffhfE9vkWD6cxZKtT1AJGoe4WIf8+VJGatPaoUEhG6OP8V/thIabrnWnKspXM\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 0783CAE8-1D27-40AE-A054-40257B54C5F8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":108004,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"a3775875c9308eaccad9d436837da5ce","sha1":"f2cb91db0d4dfcaa7edcca96a05c75a001a37946","sha256":"de09df318c409253c016871cf0e9980c44b5cea2e4cfa6317d143a5a555953e5","sha512":"b3d098e269124f5eccfed2bbb054509c497cae3137f7883ee1cd11a4ef1aafd69cc14d1f7c832d9c02b702c0a7977263bd9b579158d64ac115fdbf1b7395accc","ssdeep":"1536:ybmCxBbtKe/h/N267ElA+7YePfJ1LrToGovotEpjB2G5zrk7mJWfz5b49rCqp:yXxHt/X26Ir7Y41rpPWkGiPfNbErCK","tlshash":"b1b31205563a0cfee4eb2531451db7c3dfcf9925a60328b57052ba4a31f9b83a6b7c18","first_seen":"2025-08-29T11:05:53.200832Z","last_seen":"2025-12-29T08:12:31.315831Z","times_seen":300,"resource_available":false,"data":null}},"time_used":6720,"timings":{"blocked":5552,"dns":0,"connect":0,"send":0,"wait":292,"receive":876,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/assets/logo/favicon.ico","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.458Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:05 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 58278\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-e3a6\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1766170385=wZL4fG/IgiVy5fExmMb/Ow0HDd89uzX2ljGOp/NtAhDUJCXdjoxMqpx40PbsYHRtZQcELJzO4Cp+i6Jug5CHfX6PodfeNhGUkRn/X/sabWolXc/0V20gYNvd0jXi6czAjYDEAXiTo6c7jbK5eVDYwKcKZwM61eCf/Q/LgkgdBoQjqSvcWMAHHLi1cdLBTwEK\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 0ED7C2CE-FC95-494E-BB46-3EA4B00FCCA6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58278,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7fb9203f2701deec1371d2fd0ddd079a","sha1":"a7d4ea5f1c3d103aaa3c078bf540b56404aec0e1","sha256":"2a342dd0f9977afb12227889cf13ff008d4cf1e9a4ca07fb4131d14af05978d0","sha512":"964cf7794a7b72bb9515927efe748563b6d46fe122b35baa4c7f57fafb09ea759e5e759a3000d385872218cdd08383a58a2b66feb9a712e6f3e9a06cc87e43b5","ssdeep":"1536:e7V6OVB39Hdm34GeF4KERayBlZ3WgaOlblY4+:e7V6OV7034GeFERd3WgaOlbGN","tlshash":"af43f10a258e86c73047c3921b2dc09b70d12c776b8daef9e6bc4a5816d54731bbd1ae","first_seen":"2025-08-29T11:05:53.165834Z","last_seen":"2026-03-18T12:35:38.966648Z","times_seen":1201,"resource_available":false,"data":null}},"time_used":658,"timings":{"blocked":140,"dns":0,"connect":0,"send":0,"wait":481,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f7659ab8ded74daa9a2a20e1d6f723fe?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.530Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f7659ab8ded74daa9a2a20e1d6f723fe?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 38051\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 704\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"f7659ab8ded74daa9a2a20e1d6f723fe\"; filename*=utf-8''f7659ab8ded74daa9a2a20e1d6f723fe\r\ncontent-md5: qiJFcCxA93eZpa1LEZWBqA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fg9x5QVaTZ_PdES4ZfTaB75mnbh8\"\r\nlast-modified: Tue, 16 Dec 2025 13:13:49 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: pvcqANGO5\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: KAUAAACkBp_4sYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38051,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"aa2245702c40f77799a5ad4b119581a8","sha1":"0f71e5055a4d9fcf7444b865f4da07be669db87c","sha256":"2e5561af9330304c902ebd32b795b030ad3861bdf27efe7f61e811294a6d0161","sha512":"c65f44562e36c101f0df08339a305d99c00d42976d1301117d7546e2fa3a3118b9c503d473e1633171374be4b4f1e02e537cda7c3dbf343e85f086e6796a385d","ssdeep":"768:AdDrEvs2+haN2ZSwaFeacmeL8RAUTYS5emIlcHDMGPpxkgmq34GwrvFojQ8N/c:KDIU2R2ZTq3qAAUTYSslAHbgz8pc","tlshash":"8803f27afa5c4924aa7c03873f16d5ea1493399336a3b335ac4253c795a81347bcbc8d","first_seen":"2023-05-27T18:34:14Z","last_seen":"2026-08-08T12:59:39.062434Z","times_seen":495,"resource_available":false,"data":null}},"time_used":2884,"timings":{"blocked":1264,"dns":0,"connect":0,"send":0,"wait":1282,"receive":338,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2203bf671d924ff59a2e625ca60f2bec?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.604Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/2203bf671d924ff59a2e625ca60f2bec?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 50848\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13982\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"2203bf671d924ff59a2e625ca60f2bec\"; filename*=utf-8''2203bf671d924ff59a2e625ca60f2bec\r\ncontent-md5: V1mTLKJRLGcB2G371YOApw==\r\ncontent-transfer-encoding: binary\r\netag: \"FpZX0a6I0803O1Myx1M3RKCXIOzR\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: D2VqeRf2E\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 1aQAAAAOgQ7lpYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50848,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"5759932ca2512c6701d86dfbd58380a7","sha1":"9657d1ae88d3cd373b5332c7533744a09720ecd1","sha256":"d579be522e09c45738b602c467dcba4b7a56b9031a9fac481063c155e0539abf","sha512":"0a75664e49aa87da6e864efed8761e8f05af7d27e69929e8cc994505279ea942bcb91cda768f165c60e2c0ca0f6725a33de1ef822c446ffbed819c031a23ca24","ssdeep":"1536:UPHs8ijoHKQvvgKTlalfCmcWUrFCRBtdMd5:sHs8iM2jwr8BdMd5","tlshash":"bf33f183de15f99e99b4c7a0d277dc46177a6099763d00b0b78a81fbb18e0229e7b4c1","first_seen":"2025-04-01T11:41:17.725Z","last_seen":"2026-08-07T15:54:26.699495Z","times_seen":285,"resource_available":false,"data":null}},"time_used":3217,"timings":{"blocked":1195,"dns":0,"connect":0,"send":0,"wait":1286,"receive":736,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/SPORT.aab253e7.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.807Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/SPORT.aab253e7.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 55380\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-d854\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nAge: 51784\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: A7537328-817B-4E16-930F-C4F60F87BDC9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55380,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"3990a0dcf110f100c97ab413079e969e","sha1":"8087b72a149b71f4f5fc43b0f8bc07b89b621583","sha256":"6ddc189e7780b1313933d4903be9fbf6644b6a590e9aba83a6e4e50fdafb170e","sha512":"6b092584d42ec1423ecb94383907f29571e93308944813286d6e74b10f6eccb27536924220780f9a080dc259a095718a33f0757fc0adb04d737c83a6fa1647e5","ssdeep":"768:aEivx5zbZ4L0zze87wWbuKu4YIsZdCPX4ueh17yEs7NsGJSLsBQ1MDAaYHKJTbYC:aEi3eL0za8xbw4UmXI1VfJIRDYqz6W","tlshash":"bc43022944944c242384f1a6ac778dbc6dffa348a5f38f639a842bec7dcd84d95f4811","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.444325Z","times_seen":2398,"resource_available":false,"data":null}},"time_used":602,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":301,"receive":301,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/noData/cms_game_noimg.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.992Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/noData/cms_game_noimg.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 4977\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1371\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nAge: 51787\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 13AC422E-2A23-4739-A206-147BEF27E86A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4977,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 750 x 590, 8-bit/color RGBA, non-interlaced","md5":"84170735ffce6fe0e70a3136a36b8ef6","sha1":"5b2dcf1d5d92d786f1e58dc65de3dab1f35d7278","sha256":"581435520cde2b0026b4e7244a85b6eef0be740cb18c43690c420d1ec326d0b4","sha512":"bb0fc1b267c99db65ff3b9414576d3f4c0c9016e5309f2806a9f4d51c8c63383e9279c3a04daa5feda5489eb231a846b60040c71e5fa2798ca141b36ae0241f6","ssdeep":"96:nKdKn+AFdoSfrmrMDpdXd8nbZDH3mC+b2A:KYn+QK+pdXd8nbZ73mC1A","tlshash":"99a14be32b5d4badfe1e9a76a5549760ea632aff482c8c0e6887c955048b2144f640d2","first_seen":"2023-05-01T02:34:20Z","last_seen":"2026-08-02T09:02:15.179219Z","times_seen":2038,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":319,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.634Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_b1b5acd8-3851-4b06-8e10-d549f7f09d1b.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 24809\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=g%2Bn%2FztIsqqPHTZKNhRB%2F7wji%2FkqexAKa12tXVawOSxdnuA03ZDj42Y%2FuPZcMR8s81adjM%2FpeaxHEds7%2Bfl5RV1H9lcwTImOMc%2FEsfn80pDMm2AqRQ2TN%2FZsB2A%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"2b3edde7d1ee1537bcd21108631e215c\"\r\nLast-Modified: Tue, 02 Dec 2025 14:11:54 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48475\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a90b9eedd8a-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 172F0FD1-CA50-460D-8899-5416C0C120A0\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24809,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"2b3edde7d1ee1537bcd21108631e215c","sha1":"508e10bba0af8a922c6b1dc55839f2b4e590bfe4","sha256":"a1dc3fc36a388e88c88e99bb41f92d5788ab004390b06623899ef890cd1937c9","sha512":"972baf5313b036ed8e4c8a948873700a01f7d811488c26a36d85fc084bb20046c2f801dbe96f92b1136c864599bdfa0fc78026e124273e6ca30c31e7d1733034","ssdeep":"768:ZihR2n5VYKYE3FXL9jWZCKlXw224GKbQZuBw:ZEnKYkjWZtF6K5Bw","tlshash":"f4b2f1796b7f0d31e24a4ef3a350b9c36b67986bcecd2996e001a5c00ab3d3e414d083","first_seen":"2025-08-29T11:05:53.246096Z","last_seen":"2025-12-29T13:58:58.059579Z","times_seen":294,"resource_available":false,"data":null}},"time_used":7304,"timings":{"blocked":7011,"dns":0,"connect":0,"send":0,"wait":292,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1280x294_3ce652c0-55c8-48f5-a72d-a300accd6573.jpg","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.081Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1280x294_3ce652c0-55c8-48f5-a72d-a300accd6573.jpg HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=p6SjqJa7ie4HkeOTQqgbtgf%2FGcj1cjxy2Tl%2ByV%2BUk4HkZOw3GpmSGmWTJ4SrO%2F2FL5y3k9H12xeeOVXaUCwoTyWFHC1gG6sGgIL7tq4rVC7kMh7mkhsjGIiPLw%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"87d1015ff2e14a1f6f7b2b57571ca887\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:33 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 27381\r\ncf-cache-status: HIT\r\nCF-RAY: 9b0919ef1ec1dd5f-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: C8EE8465-1C59-4072-90FA-E434542659D3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":73462,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, progressive, precision 8, 1280x294, components 3","md5":"87d1015ff2e14a1f6f7b2b57571ca887","sha1":"630c6eb19b1145667fe91baf84895decf0d0d345","sha256":"139b3629229801138f790ec1592df247b8ea52b64260f0303c0a1a0931578de4","sha512":"7ac7fc84e76e24ca7fc132734f1a16b3bfd476bb9234a73673d104b28c1ea1637ad53f68958bcfd59a4f6d7358595d66e9f0e569c084fbd5d98ef37a2c539072","ssdeep":"1536:TNU9iSoOFwtZ7MTOwbD5vjre3CDYP9B7/+wbU5yMNg7Rlbpecj:hU9vm77MTOwP57mCDY1cwQslocj","tlshash":"367302ca87e1f2c32e756ce211751dad416066763fbef6262ceaacb187604d54a04327","first_seen":"2025-08-29T11:05:53.280437Z","last_seen":"2025-12-29T13:58:57.995004Z","times_seen":359,"resource_available":false,"data":null}},"time_used":3037,"timings":{"blocked":2534,"dns":0,"connect":0,"send":0,"wait":470,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_465faf5d-2f6d-44ba-896b-8d6bffead8bd.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 69399\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R5fvJbnpBxtCXHxEKvCCY74TYXfKdywWE4E9zLlNWNSYjutyTIsYx%2FZv8CQ3aJ%2FEzHUA5PAM56tIrTQu1RNFlzAJUKRsdXEuP6ssabKIUtrnrAycbqKB9fXeGiYo\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ba923e968e806ec3cc5e0ca4f15b6754\"\r\nLast-Modified: Tue, 02 Dec 2025 14:07:59 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48469\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047aa46a140489-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170392=LGK72/r9wLEJIr9d+AZ253CWHvbX8ozr9tp9MDldB5G8aPH3awDeFS2j9tUgnWT+6m8qQ6UEfWf72tWsi8ak8uWnSOrnl/zGOdYBljadFyiyDyDS5reeAt3jdpQhVvcane2SD+TGN1ytARChdlRlW1H4WIgzsqNovNrLQsAbv8/tMjhI6GXKOl4yva4aoW7C\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: AE57FBD6-2F6E-4D45-BC84-2E8CDC1630FE\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":69399,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"ba923e968e806ec3cc5e0ca4f15b6754","sha1":"6781e3cbf0cad47c0b41a379dd13754885427315","sha256":"191dda4470e82101bad4bd8363aee40e44c864056a114f213b56992d0ce6b744","sha512":"03d50e9e07273a54a7e264b8d66ff08c569f0eaab85fb9a87f90ff6b85cc421107dff11e8f5faf59051f9df26d22c8abe380aec5ea0960756dc392faafee9d8e","ssdeep":"1536:XUBrKrVeCYIB7URpEFD7UjVAP5mq68QB8siQSwFoySA5mjCTDz:w6VLQo0xXl/JwwFoyrEePz","tlshash":"79630255364b0a6eedcf6115da6378213889b3a9ecd8a5f429bc0d4206c2dc297f7326","first_seen":"2025-08-29T11:05:53.275096Z","last_seen":"2025-12-29T08:12:31.374845Z","times_seen":292,"resource_available":false,"data":null}},"time_used":4325,"timings":{"blocked":4034,"dns":0,"connect":0,"send":0,"wait":289,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/css/index-399e2569.1756903329400.f2d3fd45.css","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /css/index-399e2569.1756903329400.f2d3fd45.css HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:02 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-e0fa\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170382=fD3dUXvTAvqkKlHn3bIXCn0ldYgCieEWsInrTrUy2OYSNeSM3Ocx74L28Ir9Qu5IZZNTVdLIdSEvgdjLQMGdKY8rAwJgkpF4uDVhyWLRwemAIwfZs+oHw1mOuVEVgwYh/ydxqVefveJNFmABhM/gLFLt+3W80dYlTLRrtHmJoHD8gkh4JbcBxTMn6BGv6EQe\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: E758FDB7-5BD1-4001-AE8F-040FBBCA74D1\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57594,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (57594), with no line terminators","md5":"0bef4e7c4e84f6239d22f4203413192b","sha1":"f78cb75a974a7ef4ad6fb57d114c15a9b01e7fa7","sha256":"5b262fc0f9fc795ec63fd0e9afc4330757a5084ada12fd0163e40db339faf636","sha512":"65794dd7ecf908684da4c74a3360c5ddb3f51d12288d394002038de44677de9de92284164a288ca328fdaf3e15ea9aa6f16f750431488c0f3e87d68c6df6eae4","ssdeep":"768:E0ouj7X8vtr9UL5srs7hAqpLe20TCKiNkZICSA2ohGyHukQ9aaV+TJtU+WQZLq:Hop9isrQAqVe6KekWRlkQ9hf+Pe","tlshash":"6d436c2526e435ade27ba715ec91ea49312b8701f127725afb03322bc1c32f5c677b41","first_seen":"2025-08-29T11:05:53.260224Z","last_seen":"2025-12-29T13:58:58.036511Z","times_seen":443,"resource_available":false,"data":null}},"time_used":3525,"timings":{"blocked":600,"dns":2,"connect":302,"send":0,"wait":600,"receive":1709,"ssl":308},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/sponsor/sponsor_nav_web_1.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.926Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_1.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 7821\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1e8d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nAge: 51799\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: C5323A16-43FF-4268-8779-DB9412C4764A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7821,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"0eb441aa3c30cc3c92da984283938f90","sha1":"74a769808afa9b87ea483a82d47958bf05ab9b87","sha256":"146f45de163728bb850c9a8e6c1693dd4c82caf7b6e1f58728395003b84f286c","sha512":"d1c9c8824c4f42f71db8ce2b62955647aa55bb590305765cd931000d0fc6023f7d57cd3daf6992094365ca6ecb42f02f93d606d79f6643a2f89d52f71200461e","ssdeep":"192:AnUYZGCj89cpWsWKE+hAqF7k4Pk7KJw7OjF57HUNuvs7alaUd:AFEijWKE+hHF7kt7857HU/eRd","tlshash":"20f19f3eececd52cd1a745f68caf47a6142c5031ee9d7929b82fdc728649a409d403c5","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.351444Z","times_seen":2244,"resource_available":false,"data":null}},"time_used":4233,"timings":{"blocked":3934,"dns":0,"connect":0,"send":0,"wait":299,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.728Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nx-request-source: https://f214n.xyz\r\nXign: ScNZ/G5YJGZFmbvOJLpan50se+aSkRb4e93GnyFjaeXzfgzQgmAogtUzXrDXWzVTcnaGZkQaqGA1RJFW+knBd3lP/YrnjaEkgxNlqWrazRgltFokRPOZeM6Elv1kR4lWYJnByLHigRPG1XDfHl2Ar8zqjHQwmiR0C9pLKXW+NGQ=\r\ntimestamp: 1766170386701\r\nsign: 5r3t6u153f1d772d\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 29CD023D-E7FE-406B-A7AC-495081BD53F4\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19503,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (18747), with no line terminators","md5":"b62744b20485b67a816cfd3678aea26e","sha1":"8b28cbef01aa52358a8a6a44395aa555206bf292","sha256":"055b550ec276f079d01db527a3a24a765885b60c9321d25e21530f509e279d2e","sha512":"f8d7ae0465a47624007d60e3527c504f321026b47e5f14b739b72d26536a9370167b795e3c9fed2b0c41b3203d1de651d9795b525c8a1160983b6c4f6f0c3479","ssdeep":"384:eAPcP0oMzn0CdJ0ZcA0EMTl11urebmA5Hmy4AHz4lfz5SV9oHQffs8kb8/v8831z:eAPcP0oMzn0CdJ0ZcA0EMTl11urebmAl","tlshash":"3d92f05681ed18a52f5c60d25c0e7b4c987eea1b0aaef9d5ed4ece4c30b43fb9204d25","first_seen":"2025-12-19T18:54:13.73044Z","last_seen":"2025-12-19T18:54:13.73044Z","times_seen":1,"resource_available":false,"data":null}},"time_used":537,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":537,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/8ed1ef6719c64445894a69b7c020953b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/8ed1ef6719c64445894a69b7c020953b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 44104\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15785\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"8ed1ef6719c64445894a69b7c020953b\"; filename*=utf-8''8ed1ef6719c64445894a69b7c020953b\r\ncontent-md5: RatMhGsNTfWwAsVxsWES3A==\r\ncontent-transfer-encoding: binary\r\netag: \"FkcaPZ_yQXr-S4Xrsacc9Gf2MA6X\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:20 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: PcCqSBFUx\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: fsQAAABGN0FBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44104,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"45ab4c846b0d4df5b002c571b16112dc","sha1":"471a3d9ff2417afe4b85ebb1a71cf467f6300e97","sha256":"8be81f1da8fcca199b144270b8560657c1e9edb98f8144328b0401827a5b78d5","sha512":"0f1afc19b19ae3fd755dfe396fa4f99b6306fd952bbefe2747a5c074016430114957a6313ccfe463fe1535c25149902bb1bac80bcc92f5b7345b89937d5f79e7","ssdeep":"768:dZ2uraYrZFPvE2Pz/tnyBbXKPQyY0qRIujVB2cTfqb45R3oJAlTD9tsvuOY:dEuBrZFP827tnyBbaPQyPqGujm8R9tEY","tlshash":"ac13d04aca5cba36c60b4d32c7590a862fb072452813a76584f8d6b79f3963c0f4c98f","first_seen":"2023-10-31T11:08:25Z","last_seen":"2026-07-09T16:17:30.752626Z","times_seen":196,"resource_available":false,"data":null}},"time_used":3111,"timings":{"blocked":1203,"dns":0,"connect":0,"send":0,"wait":1289,"receive":619,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/bj2.a8fabbac.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.968Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/bj2.a8fabbac.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 360604\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-5809c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nAge: 51796\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 4A878ADB-270C-45A9-A124-5D816DEE7F68\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":360604,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 641, 8-bit/color RGBA, non-interlaced","md5":"e0fe8ffeed1841f74df53c3b0c1f2db0","sha1":"77bf6dfe664cdc936776654af151f49368479ec3","sha256":"db4d87e8a403e388c54dd5d114b738c82e1d2dbe65b95630fd5782179f0d7d54","sha512":"825bf73262c2b613b6a8a8397f869db6b2cd4118e554689d228503e7a04c4e674d49c5649e4ac8e2423a7b526c0f6621c259566d0e9bb6ebfa0712a7352968fa","ssdeep":"6144:iAHwIFRCiRIygxWS9v34xfZzuwbIYGzl8BPp0eIiOk3Fg7la6RUIs4pU2:rwy0IgxDEfQwbjw8dpmiOiFgpLHFU2","tlshash":"2874238d711d48cc9c9b45003dd82d9e1c55aa2f7aab20b58264fed24d17ddeec0ea3b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.55439Z","times_seen":2546,"resource_available":false,"data":null}},"time_used":2329,"timings":{"blocked":1736,"dns":0,"connect":0,"send":0,"wait":293,"receive":300,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-19T18:52:59.488Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:01 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170381=ZJGOQUVri60QTIHDszXZDUEsWjeKa8NfGUJvm7ziVf36ZH+1tUg5x0AbtS3B5TwTgTYavzHmornxU4+yZOUYj2LdN6MsIpRisBiYwZxgAx2M/MEG61bv0l27TrPJMmLgjBbQWBKq8ITn0l2a2fPHH0fTxSyxX263gWEEqsdGoDM3V3cdo83IgRLGBbPTYCXf\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 25AE64E2-199B-425B-8E49-26D4072A2295\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23624,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"87588e90bb24e209460bdbf1bcbcc074","sha1":"f3c57be16a0eaf6879f3469c6a2db7720a699832","sha256":"61ed38427305a473065294efb15ef101340cf9d3e19be35a6c6c86083698c328","sha512":"160c240e67f56096c7c519eeb5b11bd9fcac971ffbdaecd231be6aaba4f98a1dbf5f44a22c0edfbe64860e3039a11eba5be0eb13802c82e7033543d7891a8e51","ssdeep":"384:kR7B3v2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplliz:kRdviNYiKop/E6wkpcu2lUz","tlshash":"9eb2292e8df349762523703a2bbfb208797180134309ed803e4de7584fd59aa46e7bd6","first_seen":"2025-09-04T00:49:32.720758Z","last_seen":"2025-12-29T13:58:58.052747Z","times_seen":445,"resource_available":false,"data":null}},"time_used":3965,"timings":{"blocked":1677,"dns":1066,"connect":303,"send":0,"wait":453,"receive":153,"ssl":308},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/56b79a5bdc224766a2124f1d12b438be?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/56b79a5bdc224766a2124f1d12b438be?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 29035\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3168\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"56b79a5bdc224766a2124f1d12b438be\"; filename*=utf-8''56b79a5bdc224766a2124f1d12b438be\r\ncontent-md5: s8YYJEBI7K5LiTKWROWsLw==\r\ncontent-transfer-encoding: binary\r\netag: \"FsuFhm8AOxaFqZrs7eVtshLQD75Y\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:44 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 9G41uUAwV\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: _DEAAAD0b_a6r4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":29035,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 173 x 291, 8-bit/color RGBA, non-interlaced","md5":"b3c618244048ecae4b89329644e5ac2f","sha1":"cb85866f003b1685a99aecede56db212d00fbe58","sha256":"afcdf701d3478d787102bee6737b4d596c2682f692d7c19de29704afa823860d","sha512":"e6d26ccd8dc3ef69bba4c669acd0f93fb0a8923a9f890d77bfc41b9a3787c3d6244394f0b7131229a80735a2a9875b96ea363de64f2ba622bfec9d07cc9575e9","ssdeep":"768:nM3JVGDCWN2UcU0XQpVyFHYSbyAlMZPOgwDzmv7ut3W:M3J8nwNUwQpVJSllcPFwHmTuZW","tlshash":"9dd2e19fae3c95a89365dc06fc2de74d606732948cb2930c64627ec1f51bf96a30462c","first_seen":"2025-02-26T14:48:47.690798Z","last_seen":"2026-02-28T19:56:30.071925Z","times_seen":18,"resource_available":false,"data":null}},"time_used":2529,"timings":{"blocked":1304,"dns":0,"connect":0,"send":0,"wait":1202,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6fec30ae4be648d094277dc0186ba02b?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.552Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6fec30ae4be648d094277dc0186ba02b?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 28936\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 46386\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"6fec30ae4be648d094277dc0186ba02b\"; filename*=utf-8''6fec30ae4be648d094277dc0186ba02b\r\ncontent-md5: YAX48Y5BJ1cLxnhs2uVoAA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fq_gx0x9zYsGPAmYnhIydzOw0x5D\"\r\nlast-modified: Sat, 13 Dec 2025 19:04:12 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: m1CNzaaHu\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: SdoAAABEmJNsiIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28936,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"6005f8f18e4127570bc6786cdae56800","sha1":"afe0c74c7dcd8b063c09989e12327733b0d31e43","sha256":"04c38212f3c1beb374cefb5cb2a9b65f82e8ede159efa6e8a522f2da69503794","sha512":"198e5c3339da089e163a0b9dbbcb01621e8a667ad8e5c7ac1ef1397097eda76130fda634796b627c0eb4392ac9a8629c5f31f9ed03868763c27b16b752bb5089","ssdeep":"768:rvUdiKe75sFsWKS9y3HuZDq8hA5HnzboOSJzLZjK6o2diZnl:rMditsFPKcy3OZJoHnIOu/ZjKYdiZnl","tlshash":"49d2f194d2081acefbd4b1e7e54a358547ecd151ec3507d6222d96fdcb22a91b031b8e","first_seen":"2025-07-04T06:17:39.912588Z","last_seen":"2026-08-08T01:30:57.952559Z","times_seen":355,"resource_available":false,"data":null}},"time_used":2912,"timings":{"blocked":1242,"dns":0,"connect":0,"send":0,"wait":1287,"receive":383,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b38c1e91bec54ed2ab9cce1c23ebfbd1?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b38c1e91bec54ed2ab9cce1c23ebfbd1?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 47647\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15785\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"b38c1e91bec54ed2ab9cce1c23ebfbd1\"; filename*=utf-8''b38c1e91bec54ed2ab9cce1c23ebfbd1\r\ncontent-md5: /mNhiaLz23jQVUw08L2q5g==\r\ncontent-transfer-encoding: binary\r\netag: \"Fie6R1_gBPytdU0nQImKjsNd_cNV\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:21 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: b6ESbGgrO\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: BWsAAACibkdBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47647,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"fe636189a2f3db78d0554c34f0bdaae6","sha1":"27ba475fe004fcad754d2740898a8ec35dfdc355","sha256":"294d98e8d834d8de92d4cdfd34811ead33fd67f3c34e9a8b9e05937925c16e9c","sha512":"8b777480677c3c82292aff5c727a7afe9edcde55e42476a4dbadf6c8ba5e6c5c9615c3409731ec4dce92860fdbecbb7319a9cfed252050a4b7b1c0972ba2be90","ssdeep":"768:6JzoOBEsBmJMsKO6+XHI5UDCEy8sm1dqBbOl2V/uGdhgrMIWHDwneXAzbUfpD:6JzFBNmJM5+oSDq8SZOliu0u6HDWzbyJ","tlshash":"7a2301ebcf0b378c4036d4d32d9f086c562a29dbe96773cc715b201f68a993950ea395","first_seen":"2023-08-24T20:41:52Z","last_seen":"2026-08-08T13:35:45.209746Z","times_seen":184,"resource_available":false,"data":null}},"time_used":3215,"timings":{"blocked":1201,"dns":0,"connect":0,"send":0,"wait":1288,"receive":726,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/59c8d4a4f1b342ce9bd755c4aaeb12f9?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/59c8d4a4f1b342ce9bd755c4aaeb12f9?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 37830\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15785\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"59c8d4a4f1b342ce9bd755c4aaeb12f9\"; filename*=utf-8''59c8d4a4f1b342ce9bd755c4aaeb12f9\r\ncontent-md5: cqt4YqYQs1Cu92UOwOBuBg==\r\ncontent-transfer-encoding: binary\r\netag: \"FlgZ9Ff03QVVJexjzNNTLDvZdHjX\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:22 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: VnvkucJUP\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: N8wAAAAje0pBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37830,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"72ab7862a610b350aef7650ec0e06e06","sha1":"5819f457f4dd055525ec63ccd3532c3bd97478d7","sha256":"870b8d946666a0d64e22b2feec79b97c312f130723b992eab695de9eb0f34b27","sha512":"2628fb5f4e03cb7a557fe626937f6b75608c3d6eacda6c0ad4ab2518ae36381d58225d93b06bce7c21dc4e80e1289076dc3b797987e69d445f155e363feb0a23","ssdeep":"768:qXpZ+IMATEl+FUjje7nOCtHNgm2mZRj0loBTZuk25+brO/qM0/a:q5hy+FUjOHpNiEplfuk254da","tlshash":"3f03f1878b22e64d311a7f582088fb70f9095a442cb168b56064bb782e2f6572f182f9","first_seen":"2025-01-06T03:23:13.876449Z","last_seen":"2026-07-29T16:08:30.795834Z","times_seen":197,"resource_available":false,"data":null}},"time_used":3107,"timings":{"blocked":1198,"dns":0,"connect":0,"send":0,"wait":1287,"receive":622,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0317ef2e2ce142fca12cfdd8188287c7?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0317ef2e2ce142fca12cfdd8188287c7?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 88074\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13982\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"0317ef2e2ce142fca12cfdd8188287c7\"; filename*=utf-8''0317ef2e2ce142fca12cfdd8188287c7\r\ncontent-md5: xKZSii7hR7mcmIXvJDhaTg==\r\ncontent-transfer-encoding: binary\r\netag: \"Futc7GbUHdaLTk9DXTcr1ES4e9m1\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:44 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: QkuTzLi58\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: gGYAAACi4A7lpYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":88074,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"c4a6528a2ee147b99c9885ef24385a4e","sha1":"eb5cec66d41dd68b4e4f435d372bd444b87bd9b5","sha256":"e8111ed917172505f3c61bec2cefc0920e02c557cbfb587ab694545d3ede1e3a","sha512":"017f52153011e1e68c1fa47bc017f54789a78cedcd922d7376d98bb59081559b3541adbe5cad192796d8bbc74bc881e6e915b640e5486731fd0d2663cbb5df39","ssdeep":"1536:WmlDudvPFEbf8thcMRpOXFCPBs89hKkowwYRmRmsjP4UL92ILB77tVC:Wmlsv9Ebf8thcM/OXUBs89kk9wNRB9L8","tlshash":"8b831264ecd8f2857dbf9c471ab0d722e05231d34f2372449b789443fe2aa0a1ad67c5","first_seen":"2024-12-26T20:26:09.835412Z","last_seen":"2026-06-05T22:09:33.511645Z","times_seen":544,"resource_available":false,"data":null}},"time_used":3284,"timings":{"blocked":1188,"dns":0,"connect":0,"send":0,"wait":1294,"receive":802,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2e5fe153b93d454a94e2af49a6bdec94?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/2e5fe153b93d454a94e2af49a6bdec94?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 61719\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13082\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"2e5fe153b93d454a94e2af49a6bdec94\"; filename*=utf-8''2e5fe153b93d454a94e2af49a6bdec94\r\ncontent-md5: XDw5D8HLezXwbruxYBUcJw==\r\ncontent-transfer-encoding: binary\r\netag: \"FlmTgAViya1Ujj4s95TBjh1sCFpV\"\r\nlast-modified: Sat, 13 Dec 2025 19:13:09 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: ztNC5sHXA\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: dYoAAACPZ7K2poIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":61719,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"5c3c390fc1cb7b35f06ebbb160151c27","sha1":"5993800562c9ad548e3e2cf794c18e1d6c085a55","sha256":"2b89af1fe7ddac88098a4df27fe390c83387fc7f0b8601b4490c5c86a872aa63","sha512":"22f31034b1619ba448f8440fa53acf5229fd56b6e634298ebcabcf3a467071ca5045e95c2ca46f4ec0f85669166f67664c15908a646f9b969584a44b6f960624","ssdeep":"1536:KXB1CJOPsFqq6dgNZ28fosBZZwpBAoxjvfSYOaYy:3OPsod0Jfoh9yYOhy","tlshash":"6b5302c9ef21effe8350491cde049a7ad320d5ac8d8267d9961afc3d9b40e738c55922","first_seen":"2023-05-27T18:34:14Z","last_seen":"2026-05-17T16:34:28.405504Z","times_seen":156,"resource_available":false,"data":null}},"time_used":3324,"timings":{"blocked":1182,"dns":0,"connect":0,"send":0,"wait":1292,"receive":850,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c1b5a98429914aefbf6e8d2543d56815?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.617Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c1b5a98429914aefbf6e8d2543d56815?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 52586\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13982\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"c1b5a98429914aefbf6e8d2543d56815\"; filename*=utf-8''c1b5a98429914aefbf6e8d2543d56815\r\ncontent-md5: 1ppxRmw0AYwSmXliREX5qA==\r\ncontent-transfer-encoding: binary\r\netag: \"FijqU49j5N9HGaBy6QdtpjVbWKMj\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:43 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: ChE0ue1PL\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: cmYAAAAv4g7lpYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52586,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"d69a71466c34018c129979624445f9a8","sha1":"28ea538f63e4df4719a072e9076da6355b58a323","sha256":"cb00fc18d15599d05c6db877f650b957cab6be19f1a37f1ef771ff59bb4d959c","sha512":"6a0abbf618b0dfa61565f92249c3991d7114c994ba93de78b1913c1922df03376ed645fd344609a61e5147d96c2e3efb21f00f3db5b2f698b2f16b7a1b240aec","ssdeep":"1536:FvJrVUxq3bGS1ocyxIgVj5QSJ+b+bQ/XWBVNzDG:FvJxUx+bGSGqgVjTJbQiPG","tlshash":"ff33f16e147c1417180418f101fea597f8a99ea3414fbf6eebe9912f7a1337f488b285","first_seen":"2023-10-24T17:07:16Z","last_seen":"2026-07-31T00:12:52.487113Z","times_seen":351,"resource_available":false,"data":null}},"time_used":3269,"timings":{"blocked":1184,"dns":0,"connect":0,"send":0,"wait":1293,"receive":792,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/17600.1756903329400.89772027.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.680Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/17600.1756903329400.89772027.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2526b\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 993FD7C1-B6A0-4D45-8E9D-9793A28D9BCF\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":152171,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (33789)","md5":"537a1190cc025f0707bbb2a736630283","sha1":"1ac2e221c5e4e26737c6e1b7fddf2d363e4b65c3","sha256":"296f9d35557dc9588e8c6bed7134ca0e3055473306531756660582a6886bfedb","sha512":"3202114c8afb764ea0c4cd32bd78e7ad51295face85601b71b7316535d8fc29ecfb314bc1ace4ff0f54ef46a2016d09e764078ea1d7bd08ae75077ad6eab2341","ssdeep":"1536:+D5AxGst7xILpT0iiRs1vE/yKLJdLI065veGiHjLFIEfma5/xY8SbF9JiNp/QQbU:+DqxNfns1v4yKMpBesDz7+I1ou","tlshash":"d8e32a94b380717887a743b5b21f5196d22a08601098bca4f26eed94bf749ddf63ecdc","first_seen":"2025-09-04T00:49:32.979776Z","last_seen":"2025-12-29T13:58:58.065817Z","times_seen":421,"resource_available":true,"data":null}},"time_used":482,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":481,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/pay.8f35ebe1.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.011Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/pay.8f35ebe1.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 5453\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-154d\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nAge: 51798\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: A9EEF09E-2954-48CA-A7DB-863E5502993B\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5453,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 492 x 132, 4-bit colormap, non-interlaced","md5":"05d444b76263f6958a37ac82e45daa67","sha1":"a067d3a654da1ec4c51d8f049aabaa112183e355","sha256":"49166910b376f5487f30174e60fcf13aaaca9620ef1aa58cfb2c94a8c111ea8d","sha512":"7d276d57b068ec4a0125512e0781c501a96bf6c30b30304d247251190c6421a9ed7a03ec208a590d19d9a1183e3837b06d141bddd99abb7b0ee4e2a1ba28b28b","ssdeep":"96:u9g9Yof8+keuD1Kai/MXG5BHMsDiCNPFH/qX4iWXnqvcIzDRHSVyl07TrOKCm0R4:u9g9rJuYai//7FiSXnqvNYGmrOKcPwzp","tlshash":"74b18e749d6efb2a26b315c30d7499c21ea45c9e0d94f1c2244776963c732de3270985","first_seen":"2025-08-29T11:05:53.301829Z","last_seen":"2026-08-10T17:58:48.519855Z","times_seen":2452,"resource_available":false,"data":null}},"time_used":4754,"timings":{"blocked":4429,"dns":0,"connect":0,"send":0,"wait":325,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.631Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_9986c108-3fd7-4f35-9443-f78ce32e1660.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 20774\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ve16t3UXfvPEXuuIc7PQOlltwEjDuqvTlypeXiN8%2Bj8WQIFfrs4YfXFDbu068hfxy%2B%2F0Gt2WglKZ%2BbMKB0ue416XIy1tFb%2BtIpTzJ9RHWf%2FIuqel9k5V%2BzwfyelV\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"b4734010f7828ca2c22c389ee510755e\"\r\nLast-Modified: Tue, 02 Dec 2025 14:11:36 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48461\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047ae95a9c0505-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 437D85A0-5349-4B75-9AE2-F77FAEB63781\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20774,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"b4734010f7828ca2c22c389ee510755e","sha1":"757202b8e2a145b911c7d7693bbf5fd753ede9e6","sha256":"7baac8631e3b6377f2aff7262dae5a82e2e5f5ce14edf950e64e6426e674cff4","sha512":"fa9b53fe2c82ab0fcdd8f6d004083cb25c718eca270b6866a760de7df1775ec06b8be572baa3dbf90e5da20f0a9d807ee10df13b31e397b2ac35ffb78d5070e1","ssdeep":"384:7MUqGTUfqNN66k60ie1NIgiVG+V+DhwuNJ7SOEOsWM7RKjFQ8ZrG++eR:7YwUfg6I0b1N9S+DmQJ7SLOIAji8Z6g","tlshash":"e692d0d3168a6abbe615da79c15e10879ad2a00155f8f9038db7c74bc7324cc0979bc3","first_seen":"2025-08-29T11:05:53.157247Z","last_seen":"2025-12-29T13:58:58.067607Z","times_seen":293,"resource_available":false,"data":null}},"time_used":7297,"timings":{"blocked":6998,"dns":0,"connect":0,"send":0,"wait":298,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/c8b51b55c2c44bb98012f587979aa3f5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/c8b51b55c2c44bb98012f587979aa3f5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 84481\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2628\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"c8b51b55c2c44bb98012f587979aa3f5\"; filename*=utf-8''c8b51b55c2c44bb98012f587979aa3f5\r\ncontent-md5: kp07jrxqF44rn9eFKP2tCg==\r\ncontent-transfer-encoding: binary\r\netag: \"FtJnpmcIcTk8tLfASBwBZPNCY8No\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:41 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: Gbacz3yH4\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: hNAAAACLQbI4sIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":84481,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1304, 8-bit/color RGBA, non-interlaced","md5":"929d3b8ebc6a178e2b9fd78528fdad0a","sha1":"d267a6670871393cb4b7c0481c0164f34263c368","sha256":"27455ec72fb7cda74940704829672fcd31b03f0f455334085275f938bb26f563","sha512":"3453ae96142cc7629f4557beadb53c895b34b744ea1f64732920d087a6544fa57688b6a0489757858b84e14d33dedafe84b10a2bf2dd79aed0264739561900c2","ssdeep":"1536:E4wxZNn7NoZ2xP98kaL8nsf/6MWasy2Ry7MdwQ2BkpxU8lRbAxwOb:qNn7Nm2J98eM6MWas078wQ2BQfvcxwe","tlshash":"c183e142fe6bddf6d95302304fb51a45d8b45a778be1623fa216413d8e812901affce8","first_seen":"2025-10-01T18:49:09.085527Z","last_seen":"2025-12-19T18:58:52.040218Z","times_seen":10,"resource_available":false,"data":null}},"time_used":3178,"timings":{"blocked":1317,"dns":0,"connect":0,"send":0,"wait":1088,"receive":773,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_91f2d885-8341-4928-bace-352c8c691bef.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 21794\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2Bqr%2BP5%2FWiZvBGln7%2F%2FyVcGouSJT969YsGPz2Htnp97nEz7OfK8pTqSr69l%2BYEFqYyK6EHuY6FEX57%2FDaheOAj9vG%2BaYdgdiVvoXY4HLUfxTSO5%2BXSrVbvIV9Kgpv\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"05954182d3e76bcba1d9910b7be852aa\"\r\nLast-Modified: Tue, 02 Dec 2025 14:08:25 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48468\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047ab25b37e5d4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 63E888D3-002D-4C8A-8DC2-D4EDBE8851AF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21794,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"05954182d3e76bcba1d9910b7be852aa","sha1":"3617dd01f0d33d63148a64c12fa0fc800d5329d9","sha256":"74e1f25ab615997c5ccbc6b22e6f6f8ad738fc1b4f347ef2161aa7e0462fca0f","sha512":"b3979ea799e42e976794e05449f2345983d6ca8b5fa3a8aefcdd0361a6eed1ee9bf7099339cba4e814c468077d65c295028093b54b92adbe681dac638a1a47f7","ssdeep":"384:ITj2Gcb4jiuqtG/BJCcX6w849XLCXk4jaQR1SkZPKNCFDWDIzDH9M49r9b:ajk4j/yOhl7CXJ+QLSQPKNeN3v9Zb","tlshash":"c4a2d1f94f476cb8ed9f14b4a37d1360d3a85b8af12197ac12d31a6cdde04321a15aac","first_seen":"2025-08-29T11:05:53.291531Z","last_seen":"2025-12-29T13:58:58.043263Z","times_seen":299,"resource_available":false,"data":null}},"time_used":4611,"timings":{"blocked":4321,"dns":0,"connect":0,"send":0,"wait":289,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6627fb6e23304a2aa1494f22e1fd11a6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.419Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6627fb6e23304a2aa1494f22e1fd11a6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 27582\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 6953\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"6627fb6e23304a2aa1494f22e1fd11a6\"; filename*=utf-8''6627fb6e23304a2aa1494f22e1fd11a6\r\ncontent-md5: ulQycw5uHYUlmd5LIVAzHA==\r\ncontent-transfer-encoding: binary\r\netag: \"FvdYbNikaKcK7QwSqYKaCo0yrtJi\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:19 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: m3qEMpGhC\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 9sEAAAAGs7xJrIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27582,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ba5432730e6e1d852599de4b2150331c","sha1":"f7586cd8a468a70aed0c12a9829a0a8d32aed262","sha256":"3c504d063dca4b5f2e8a34a08fe54a2da2d5ecefb6ebe5508d66b66da52d39b8","sha512":"f2ff9a03af036623c5ed0299da2b6a30b150ef05e064c00cdf43208045f64694232094ceff8a8ea6b863e5b5499eafb573310ad94e5b3894f01eb065c3b3a0a1","ssdeep":"768:+zaNPjNr3IqR1U1/tF9KkF7k8Asz6Uc/yKSgoT:zPjHR16/P9VgFQAgNT","tlshash":"0fc2e141ce00b0a15b0e9e21d9d8e91c86768ff87fba26b76491b84d4a624925ed7e0c","first_seen":"2023-05-30T11:51:17Z","last_seen":"2026-08-08T00:56:42.139122Z","times_seen":44,"resource_available":false,"data":null}},"time_used":4495,"timings":{"blocked":1610,"dns":642,"connect":249,"send":0,"wait":1070,"receive":200,"ssl":720},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/6f1a7cbab3ca426e8d9d12737fcb6b05?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/6f1a7cbab3ca426e8d9d12737fcb6b05?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 24749\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 6773\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"6f1a7cbab3ca426e8d9d12737fcb6b05\"; filename*=utf-8''6f1a7cbab3ca426e8d9d12737fcb6b05\r\ncontent-md5: EN0vxH9tN2aoFjXoMPjTCg==\r\ncontent-transfer-encoding: binary\r\netag: \"FlBYMIP-Zi9ejDclECd5fsROPmgk\"\r\nlast-modified: Sun, 14 Dec 2025 19:03:17 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: YF0wcUxGE\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: SYoAAADLp5xzrIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24749,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"10dd2fc47f6d3766a81635e830f8d30a","sha1":"50583083fe662f5e8c37251027797ec44e3e6824","sha256":"dec059657529191c80ba447de3c4d44628e7413cf0e45fdf7214381a8db1464c","sha512":"c36572db0c47e3e590481b34dbbc46e83cd6776ad5f1ed1ff4b3832cd8c594cf8795357cbe341e9b0d02e258500dbaef4f5b03adca87c45b29e821c9359f09b9","ssdeep":"384:9TX26VgNNHpJiRR2NnkVbWwiWw209T8NQb2cualiXjHkupBDqXHiP:ZX2Yg7DNFOQcQb2cualWnpx4H6","tlshash":"aab2e0cb47139568b34c0ebcce8c5ad52f417516946c482d413da93abd1c08bedab5bf","first_seen":"2024-12-26T20:26:09.833086Z","last_seen":"2026-05-17T09:49:30.7467Z","times_seen":207,"resource_available":false,"data":null}},"time_used":2912,"timings":{"blocked":1179,"dns":0,"connect":0,"send":0,"wait":1294,"receive":439,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/aee70b5490c349bc96d60aceafaf80f9?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/aee70b5490c349bc96d60aceafaf80f9?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 113581\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4971\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"aee70b5490c349bc96d60aceafaf80f9\"; filename*=utf-8''aee70b5490c349bc96d60aceafaf80f9\r\ncontent-md5: ChHnFLjMseKHUghXvWzwHA==\r\ncontent-transfer-encoding: binary\r\netag: \"FraOPrljDrunas9QWYsKdgt8gWL9\"\r\nlast-modified: Sun, 14 Dec 2025 19:03:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: VWnaPuRHs\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 0igAAADGPTYXroIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":113581,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"0a11e714b8ccb1e287520857bd6cf01c","sha1":"b68e3eb9630ebba76acf50598b0a760b7c8162fd","sha256":"ad22fbb2a80750a62150119c95d1f1192c1b4083b000994e99431857f5fb6ec7","sha512":"641de85a2a2481828f89891bf8e460fe815d6063068b6140e72b673b97ad4550c7ada3f73385916e2245cc5b4307abf0146a9554da86ea3cf7d110fa0e3996b8","ssdeep":"3072:9BDBVGdym3OhOTQJPhBMpH1nB6yvPX4PS8TNEA1:LtVG8m+XJOVnBWTNz","tlshash":"6fb312761cece09e664f1bf1340084778e088649d966cfc18b6ce97f98b962c278d52b","first_seen":"2025-01-29T13:39:14.661465Z","last_seen":"2026-05-24T05:41:01.341666Z","times_seen":393,"resource_available":false,"data":null}},"time_used":3287,"timings":{"blocked":1175,"dns":0,"connect":0,"send":0,"wait":1295,"receive":817,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_4d4d0270-e129-42d7-8f6f-0802c910d540.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.583Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_4d4d0270-e129-42d7-8f6f-0802c910d540.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 98652\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DL3z1NR%2B8A%2BPYQ1FcpE1G%2Fg6gEdBdG5w61j7mksEscycE0%2FmEisu%2FSvirqjUFrXKa0Av2aEaTemZSPevBSD6Oc2FareZ6FQHzBdtxlLlZV7%2BeZk%2BJVbN%2B18UPyVk\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"74973ccf04bec417d676dfe9f7d015d9\"\r\nLast-Modified: Tue, 02 Dec 2025 14:08:45 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48482\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a541a31f1c6-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170392=LGK72/r9wLEJIr9d+AZ253CWHvbX8ozr9tp9MDldB5G8aPH3awDeFS2j9tUgnWT+6m8qQ6UEfWf72tWsi8ak8uWnSOrnl/zGOdYBljadFyiyDyDS5reeAt3jdpQhVvcane2SD+TGN1ytARChdlRlW1H4WIgzsqNovNrLQsAbv8/tMjhI6GXKOl4yva4aoW7C\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 5D2AA57D-7E5D-4C0A-9B6A-BC914D82B2F2\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":98652,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"74973ccf04bec417d676dfe9f7d015d9","sha1":"e7e62ac239d28e2b8dac2d8cfd8d9615731fd3f1","sha256":"58df7978ec4544d5cb054faaaf9245726ffe8d23c90b5855c532e94c0f18d1af","sha512":"03a7edc294e891fbd39caaf37374b49c5a3442fb67818cb7c627b79fb5efa03523d58e3c05cc390b502be6343c5f893528eba6bc9ddf823dc250667cc41dc9c4","ssdeep":"1536:CFBr22t7Zt8sNmGduq1o9TFb6LSPkOUOW8lX+wm8fCT2xt7ckUz+PevOx8EE:WLJSGd69cakf6j/fK2H7ck/KKK","tlshash":"60a3023e741267f2d3e1ec8fe2d5ca4b52e5d0bb41634183326e104a4f66e219b5af47","first_seen":"2025-08-29T11:05:53.331862Z","last_seen":"2025-12-29T13:58:57.997464Z","times_seen":294,"resource_available":false,"data":null}},"time_used":3904,"timings":{"blocked":3579,"dns":0,"connect":0,"send":0,"wait":320,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/65246.1756903329400.c090be2c.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/65246.1756903329400.c090be2c.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-11f2c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 46E423D0-B91B-457B-A90D-9FCB0FD290BB\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73516,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (48688)","md5":"9695de283c01f0fadf4795c612b010e2","sha1":"9e9b20c41d8eac731f465f87713f570eee532180","sha256":"82d3d78a522caa25376deb145964490b699e6d2c976ae6cdad15f2c4e57cfc7e","sha512":"5f583070eebf753cebbbad1720360c270ec09391ef530c0efb982a92e03b1a10689136cbb74c005fa386f20111b32a602557c0fdf5e2d716062da09d942e2f6e","ssdeep":"1536:r2+iDvYvNjx4Uyao0L8oDNzAuMMsTAQ0mqt2pXYzA4dANV1:i+iDYvPo0L8oZzAuMMsTA7mqt9zA4dA1","tlshash":"c773a501f78272384fa7e290220f2026e16d191505ac5bd8f179ffb93ef4954aa7d7b4","first_seen":"2025-09-04T00:49:32.778143Z","last_seen":"2025-12-29T13:58:58.019409Z","times_seen":420,"resource_available":true,"data":null}},"time_used":624,"timings":{"blocked":152,"dns":0,"connect":0,"send":0,"wait":471,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ae2cacd22787412a98304f150cd4e9e3?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.454Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ae2cacd22787412a98304f150cd4e9e3?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 9667\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 5091\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"ae2cacd22787412a98304f150cd4e9e3\"; filename*=utf-8''ae2cacd22787412a98304f150cd4e9e3\r\ncontent-md5: H3SEO/L//0dNI9OH+iQBAg==\r\ncontent-transfer-encoding: binary\r\netag: \"FgkBv5m66Nh7eL6E-H6ni5Go_LTh\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:30 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: XBOCrIDKq\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 7nQAAABTwhn7rYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":9667,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit colormap, non-interlaced","md5":"1f74843bf2ffff474d23d387fa240102","sha1":"0901bf99bae8d87b78be84f87ea78b91a8fcb4e1","sha256":"d29775ebcceba0170b3c910d29edab496246604436ec4447096faf1abdaebb1f","sha512":"95cd496effa04b0a5b282bbb5df17287995df398c3e13d6c6219eb6da60e185ddc8299c8d91adb0c3918873cbc0065a6956d0e03edcec7df1fdcbe6c7c8e9a61","ssdeep":"192:4PwRZCBkBzPCoOVb8mXQCmuDT8eL535HcAa8uvrc4ZJS2+bBonF:HWkxdOK+QCmuH8e935H2XvY52aBoF","tlshash":"ed12b0d6f17bc9f291757b081c129cfce0eadd512ed3ca68c639b860573d42561453c9","first_seen":"2025-08-01T05:00:14.093451Z","last_seen":"2026-08-07T15:54:26.6142Z","times_seen":42,"resource_available":false,"data":null}},"time_used":2276,"timings":{"blocked":1338,"dns":0,"connect":0,"send":0,"wait":937,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/dfdf84eece3e448fbb8914e6d22ae94d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.584Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/dfdf84eece3e448fbb8914e6d22ae94d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 19771\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21160\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"dfdf84eece3e448fbb8914e6d22ae94d\"; filename*=utf-8''dfdf84eece3e448fbb8914e6d22ae94d\r\ncontent-md5: /ZVNCD7oWm8aPyRx3HViQg==\r\ncontent-transfer-encoding: binary\r\netag: \"FlXwTYPQH0AsMIt25PqWp_sfeMeu\"\r\nlast-modified: Sat, 13 Dec 2025 19:08:07 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: TM9A5vQVc\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: HicAAACEs_hdn4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":19771,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"fd954d083ee85a6f1a3f2471dc756242","sha1":"55f04d83d01f402c308b76e4fa96a7fb1f78c7ae","sha256":"1576760ad926f7ac4d0daa1f4ddb9948ae4a94b76cadce6ba06aaa7de2fb87eb","sha512":"3a12da7da28de16f0d3c8ae950f38c7279e56ac8911f1723493f4ed50613a02e276396b9e036dd5b0615895340810eeb45fc071f9d348381b0ac54149509cb77","ssdeep":"384:FkY/8NldeH/VQNkZCl0E9drsnYqZVXW9URWkUIHG3nQ6VVwWiAqkNcR:eq8fsf6JAYqP/UImnhvQkuR","tlshash":"9792cf270a7fed708d1ed3466569453e801fb03c392bb794ed8692ea1bd081d8e186b3","first_seen":"2025-02-21T06:40:25.57561Z","last_seen":"2026-07-18T18:51:21.705107Z","times_seen":259,"resource_available":false,"data":null}},"time_used":2924,"timings":{"blocked":1212,"dns":0,"connect":0,"send":0,"wait":1288,"receive":424,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_95e34ac6-aa0b-4d3f-9ae0-451b7e2983d6.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_95e34ac6-aa0b-4d3f-9ae0-451b7e2983d6.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 438063\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9YnKGhmRWKFZU%2FOm0oFiI0GPb8DqWEvl4RCtIOUGeSiXYzqXqpAYSHkwVVYiQR4%2BTGtQmQtWu8Cs4LD2yhtkwukSnUdfzy8e%2FbpHL4L%2Fu%2BiLEm9cltE9msJwXeH6\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"c6ff174b67891a7651c6946ba0093c36\"\r\nLast-Modified: Sat, 06 Dec 2025 06:17:03 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48477\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a705a525df3-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170391=tUOZ8RdTGViMVT0qRVsHCkEd/bDSrV60ZM36/1fg7dt4ymzJSog+mHM4PBbyfXIj2cVUcwU+RjuOWIEUq07ZLMXkXynq8W+d7yA3jAb0vlIqzxiyuLdsPuMnf0EFrtUwzrvVSH/Y3ArQqqkbbBowjMGG+qwqGfdwYBD3k8xlLq7ltX2p13SyD4ww+LGigZTL\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 6C027222-BE28-4384-93DA-7E688A67447E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":438063,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"c6ff174b67891a7651c6946ba0093c36","sha1":"9d06251e9b8c421726b82f55fff19b2a854cb2cd","sha256":"c04aba88088a64ef4e63d88f5502f7073bfcbe25365c8445ace5013ce2a251d3","sha512":"acac318e6335c4dfe2deabd41b9b002dc9b62c1c4bae0b51e0a493949aebc14845b2b08d9df2e0073f6b282a512283ab4432d4c41ec8dc56405803beece73010","ssdeep":"12288:NtVyoEN5CQHKmFDdTNM0mCsjVXVM+OMPMTmT:NtVyoqCnmW0mnjVX7Z","tlshash":"1a9423683441290e0074e65e8b8403535735dcfcaa3e69f1ba7c31a96c7ea3b46fa75c","first_seen":"2025-08-29T11:05:53.2152Z","last_seen":"2025-12-29T13:58:58.066851Z","times_seen":287,"resource_available":false,"data":null}},"time_used":3584,"timings":{"blocked":3239,"dns":0,"connect":0,"send":0,"wait":319,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/chunk-common.1756903329400.8e9f70b3.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.832Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/chunk-common.1756903329400.8e9f70b3.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:03 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-26f1c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170383=1W/hvTJ7VLMXLjYqCI/hcH7YzzLc/epwkUArNXRBzTTUcsKCEEwzjCIAux4YKouZCg57Mb4bi2tNcqSv1JFtoEoK8R5tyQygGXQd50o8fJ51dSmXkpHV0OROYwO3/vs09Zz8pswZ3/eO2l0iAwqvTQ/gYGVcFuqJDQZWJoysdiISwe3A+ihlPsYDp9nkxYX5\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: B6DFAEF4-0DF2-4B64-8FDE-5EA107C761C7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":159516,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"1b35e779a9012cf73988d1d4b0d9e5f2","sha1":"c139c75aed4b303657e5a48a1fb036d7fcec6533","sha256":"9231e7c73c53eeebd2a055dc9c7402342f21053dbbbdd257be62eaf29c98fafa","sha512":"53ab4c8aaf4fb2bd81c55c7356348b96d509ee4f2a91869043061c8b6ffac404ce76a6ca57caddd47e94dfa5e821a3e6a85c969cc94675fe8625cf44d689c05d","ssdeep":"1536:6ZVB2bNNcdWUc2UTC6oryXHuLmbErF/G7D1dMI5MHLui7TAN/voVG5glVbGD3tFZ:6ZVBM/TC6yjFecHLui7T4/voVG5agD3t","tlshash":"73f3e8c5b3a0f07e9a1ed53779331499b12f758274c87c60f1a1ada6bf19708a436ca8","first_seen":"2025-09-04T00:49:32.82259Z","last_seen":"2025-12-29T13:58:58.058135Z","times_seen":438,"resource_available":true,"data":null}},"time_used":1977,"timings":{"blocked":1195,"dns":0,"connect":0,"send":0,"wait":483,"receive":299,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/ce9274ffd21d2e854312b3dbb77b707c.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.2.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 19 Nov 2025 17:04:23 GMT","end":"Tue, 17 Feb 2026 18:04:20 GMT"},"fingerprint":{"sha1":"A6:E0:51:55:F3:DD:1C:A3:91:3B:6B:52:24:2C:20:18:2C:4F:CE:25","sha256":"53:84:30:04:E7:7E:B1:BB:5C:2E:FE:6C:8F:08:8D:BF:9D:85:E2:A2:5E:E8:25:B9:21:25:A2:5A:15:88:C1:46"}}},"request":{"raw":"GET /202/1/ce9274ffd21d2e854312b3dbb77b707c.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 18:53:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 96787\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"33e7ad6e34950bb9743e157561f60341\"\r\nlast-modified: Fri, 07 Nov 2025 04:20:15 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 1882B1AB0CFB4AE5\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1035\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x5rbQy76yPVqbUJDah%2BL3UZATZ9gvIf3ik%2BBTcIXvAwq5Y0z%2BdHLsDvH766Iuprdtw1WtJt1v2KKHiRP3CcGlv%2FouVpMRWb%2FaX4DuaYLRkHJ\"}]}\r\ncf-ray: 9b0919db08ab2efa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96787,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 302, 8-bit/color RGBA, non-interlaced","md5":"33e7ad6e34950bb9743e157561f60341","sha1":"58b88e8714e2c881fee44e0f66900cec71cbf1a8","sha256":"ae1c70a6945ac64b3fb93ed39ea964add4902b4ab1e7c5245bca10b5991dea54","sha512":"6a5c2868b0c95134e250f54dcf50072b8c99449b0c9bfe5d75bc99ff3ec05608ef317d2f794151dac7e1a601ee2267bc7e81781dbf0985a07adccc5888c4ae3b","ssdeep":"1536:k+01hH3kjBo6GQDqjtVRjVCi/4KTupQ3gVrM34ww82U4yknHFfxFwmuxfeWa6q:aN3t6dGjXFVCfKT0maJwRBmFwVfO","tlshash":"98930272923bc97f48029b706ba6bc5962902ba26c851f27cc74d1e4b6234cec7851fd","first_seen":"2025-10-18T16:18:03.071261Z","last_seen":"2026-08-08T00:56:41.916486Z","times_seen":60,"resource_available":false,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":60,"connect":3,"send":0,"wait":8,"receive":11,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/partner.dca3fc6e.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.008Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/partner.dca3fc6e.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 28969\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7129\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nAge: 51798\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 9A66BCAD-B372-451C-8905-19356D1732CF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28969,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 480 x 151, 8-bit/color RGBA, non-interlaced","md5":"7374b72d05130af2d77119eb0eb4ba10","sha1":"5b3e5e621329685de250121b2fd9c798f46f7d65","sha256":"059a622a7f1f0f1f239d624f19b0f5531c0f0aedadb8ccd40d2570a76dd56752","sha512":"c2d0f744838a882c8ac15de6bb0bfbeb3dd2f31550cc7a259b9890ea38eddf835902171c1346ed7e1d2005ba18b929d598002d60b7355df72073d955521b18b0","ssdeep":"768:tAAoY1X4ITISUWhiqmMiuCaUENwHoacq8zqWx6:abaX4SIYIdMMow8zqi6","tlshash":"a2d2e0ecdc3058f1f533894dc979813a6f3886ba05e359817a36f92bddc3e8506491e6","first_seen":"2025-08-29T11:05:53.287538Z","last_seen":"2026-08-10T17:58:48.502963Z","times_seen":2456,"resource_available":false,"data":null}},"time_used":4607,"timings":{"blocked":4317,"dns":0,"connect":0,"send":0,"wait":289,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/chunk-init.1756903329400.f53cb96a.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.831Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/chunk-init.1756903329400.f53cb96a.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-42aa8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170382=fD3dUXvTAvqkKlHn3bIXCn0ldYgCieEWsInrTrUy2OYSNeSM3Ocx74L28Ir9Qu5IZZNTVdLIdSEvgdjLQMGdKY8rAwJgkpF4uDVhyWLRwemAIwfZs+oHw1mOuVEVgwYh/ydxqVefveJNFmABhM/gLFLt+3W80dYlTLRrtHmJoHD8gkh4JbcBxTMn6BGv6EQe\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 2ABC4FA8-009D-4C7D-8F65-688E42287A8E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":273064,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (44101)","md5":"daffbf99400a4f119f452d48a10ea62a","sha1":"0ae2d45d2befd0f11ae9373195c409f491a511d9","sha256":"1dcfbbb596d333e200aa1b0e4e282c296f29bfafdee19ff4014fad30a394ae45","sha512":"8e39ce35d7f18deb579cf03330a935e18308541617b1a265e4d7f88480b4d29608598e6d2be86328106fa64c4d707e608f333319bd1e7627df53a0170de079fa","ssdeep":"3072:etwqhOIKENB85doKa/x5wc0dB5/J+UUknCqdnr4QMA/C:HENm5ox2Br+2nCjXz","tlshash":"ea441b98b3d171b846cb53e5622b1035f6ba1ca33098e4f0d219ea547f3168dd52eeec","first_seen":"2025-09-04T00:49:32.986263Z","last_seen":"2025-12-29T13:58:58.044472Z","times_seen":443,"resource_available":true,"data":null}},"time_used":1522,"timings":{"blocked":434,"dns":0,"connect":0,"send":0,"wait":480,"receive":608,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ccaa2f55c552440297c233273ddd323e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.481Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ccaa2f55c552440297c233273ddd323e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 7712\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3289\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"ccaa2f55c552440297c233273ddd323e\"; filename*=utf-8''ccaa2f55c552440297c233273ddd323e\r\ncontent-md5: v0Set7VB5hkVitpgPQc4WA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fp7Bx5JkFBynKm7Bl-oSf6cdH1Ip\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:38 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: udemluBr5\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: cBkAAAD0XdOer4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7712,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit colormap, non-interlaced","md5":"bf449eb7b541e619158ada603d073858","sha1":"9ec1c79264141ca72a6ec197ea127fa71d1f5229","sha256":"d30b44d2496a03644fa36d759c0f2183f72979dd3d2bf718e99e656fa93c68c5","sha512":"12be1cde7f5fb2b524d4d21f591513e94796baeca7abd9fb85d082ad1398ea3606dec15ea4e56c5843a018464243f4bc350a0001e3bb46e81b0b4caea90f06e6","ssdeep":"192:5BStYHM9XcWWCRtFFDouFaAgmJF33LLMDS:3SB5J1RtFFJa5oF3nf","tlshash":"61f1afab6be68cedb3c11d7db31ad30839e628a3483d54d6c943623ad8384c5c5c20d4","first_seen":"2025-12-03T15:27:28.971427Z","last_seen":"2026-08-10T15:30:39.072724Z","times_seen":122,"resource_available":false,"data":null}},"time_used":2449,"timings":{"blocked":1312,"dns":0,"connect":0,"send":0,"wait":1088,"receive":49,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/1899e77e64f342138d5a0c0dbe46a1b3?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/1899e77e64f342138d5a0c0dbe46a1b3?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 7700\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15785\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1899e77e64f342138d5a0c0dbe46a1b3\"; filename*=utf-8''1899e77e64f342138d5a0c0dbe46a1b3\r\ncontent-md5: qvN70x8m1VtunwM2r7KbyA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fn5waJl4B6YMeG7kHVtOd3myxYLJ\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:21 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: buNCiyoBj\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: FBoAAACfzkNBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7700,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"aaf37bd31f26d55b6e9f0336afb29bc8","sha1":"7e7068997807a60c786ee41d5b4e7779b2c582c9","sha256":"5f9c9bdd6cf50b02e7e8e307d951eb51ff0cb289a32794754ad636cb479c7ece","sha512":"52d9dbe304dfbcef526d3eae380a82ecf541aa53bb6df908bef60cc4eb23c2042f6003408033c21aee01311156ccdec39b7dbcfbd26507663d0e20216e900180","ssdeep":"192:OsJhL853SZ6m59y1B8CXc2hVB8h484lDj:bJxuu6mnU8Cs2hw74ln","tlshash":"e9f1aec98038c2713d1f45b2f6393f431b3b32887ae53885e4ba1d6d47a7e6345a950b","first_seen":"2023-07-08T08:51:56Z","last_seen":"2026-07-18T18:52:49.188391Z","times_seen":208,"resource_available":false,"data":null}},"time_used":2927,"timings":{"blocked":1202,"dns":0,"connect":0,"send":0,"wait":1297,"receive":428,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_3340babe-d86d-4379-84e5-92efe2221568.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.562Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_3340babe-d86d-4379-84e5-92efe2221568.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 482221\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JmlNrS3xiszQNyb42VT%2BrMah%2BuxsNJnSDBnIEX59bsSWmJBGEBxRgJp%2Fl0sGZw236sMxEHl7gpRDUU0bLkNwDe4FONN%2FElAamoERs34TKuE%2FEdpfkUXkJcdzku8B\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"f7ef4e37a62c368c1cfc0a2e7f9923f5\"\r\nLast-Modified: Sat, 06 Dec 2025 06:31:44 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48451\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047afd7f91e2f1-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 93928551-114E-4BE0-A8A8-BD774742AAF1\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":482221,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"f7ef4e37a62c368c1cfc0a2e7f9923f5","sha1":"60b9a2019430f28a3e93fe500d293bd338686cf0","sha256":"bb0f3a60618593a93b138b40eb5990d34637c9261c7b758c834a3276950b076b","sha512":"096fb344e49b180a3e600985b27b9d3413525093ce06d6e5b66fabd0c11fd32b1547aebde698101595fd3a1e54ff541b24e86fd13b36cd7042eaf2133d5f6956","ssdeep":"6144:aNJaHi/7KQR9nGgwCN4i1jsFl1SzbFKGQSg1ru9KlrSg6BDC6q9LHnXnBkZJRS9s:3H871EyvlsFIc5wgFCmRcJ89qY4m6","tlshash":"c4a42301c0b1a6cbedbb99d132100b9f7c93eb4f2d2592b96c95fd7859b015b2e28464","first_seen":"2025-08-29T11:05:53.104502Z","last_seen":"2025-12-29T13:58:58.004708Z","times_seen":285,"resource_available":false,"data":null}},"time_used":4907,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":578,"receive":4329,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_50b16c20-cbfb-4c4c-ba8a-249055c85af3.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 133257\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OF62ilLHHZcKdo86KjBi%2Bu5Naz%2B%2FaCdjehzB4yv20heLl7tdAvsxQMBIyofO7RqVsAk%2FJVsARS4OmlvZpsOVBpTvUuSx9Qebl5p0KFo%2B80WBDJuUsC5JavJHrz7j\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e932d01be4f46b30fb7820d0a6ecaa8e\"\r\nLast-Modified: Tue, 02 Dec 2025 14:07:32 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 51768\r\ncf-cache-status: HIT\r\nCF-RAY: 9b042a1cecdf03e9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170392=LGK72/r9wLEJIr9d+AZ253CWHvbX8ozr9tp9MDldB5G8aPH3awDeFS2j9tUgnWT+6m8qQ6UEfWf72tWsi8ak8uWnSOrnl/zGOdYBljadFyiyDyDS5reeAt3jdpQhVvcane2SD+TGN1ytARChdlRlW1H4WIgzsqNovNrLQsAbv8/tMjhI6GXKOl4yva4aoW7C\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 4C0CB93F-5720-449C-9017-F56D6A21553E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":133257,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"e932d01be4f46b30fb7820d0a6ecaa8e","sha1":"8ed805238342c4428630a620898688c541d49d8c","sha256":"237a03a4d6554209676acd0d140a2194419ce3672b849cfaa99df1bd8a31fcac","sha512":"fe1dbf59bfd451cf5c9080af7c932b8d8cde5eb25cb58568d7cdaf3c1a4015d1e858201775291bd74872d7e0444746def52d068c58fdeeabffcf8d21acd2a493","ssdeep":"3072:IDJzDKb/eNOyrjQyTU0mZn12vOjQiSWT+UPNeaHp1nvDeEUiu0GGXf2quOn9:wPKbE5rkyTUDTVQdWT+UP/H3n6EneqP9","tlshash":"09d3123a7053df65d92ff2a8e11ef8caa5722729cbab1945c80dc98615220789c83d73","first_seen":"2025-08-29T11:05:53.12363Z","last_seen":"2025-12-28T02:09:46.269424Z","times_seen":297,"resource_available":false,"data":null}},"time_used":5274,"timings":{"blocked":3819,"dns":0,"connect":0,"send":0,"wait":585,"receive":870,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202502/_raw3_size328x442_27f7b303-88a3-4b2c-aaf9-2bc0106b5d62.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202502/_raw3_size328x442_27f7b303-88a3-4b2c-aaf9-2bc0106b5d62.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 142348\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=O00tcTekPqlbyrB097aeo6MVE9rERA0Z5mLvkJjjPc8YS0WeQ8YkvPxTUikIbEJGp41FafJ8m%2Fz22fXxoHb9kwswa8I4of1imau3I%2F%2F8fAASx0LUQm7IIA6VwcyU\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"1aba814fc168b414bb58dc6134274d81\"\r\nLast-Modified: Tue, 02 Dec 2025 14:16:56 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48456\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047afd4c3bcd2f-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 5056321B-6B46-4C51-BBA8-A094CA949639\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":142348,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"1aba814fc168b414bb58dc6134274d81","sha1":"2c4644e685cf8666032b9109d6cd0330db2695a2","sha256":"4e5f7a80e67fce0d6655ade909560ba442ded2b9b5f29b3b61118bdda5e36957","sha512":"44fd53c792e7d2ce5de8f0514c8dc5ab2528ea2940754369a8814e92d3144cc9d2bf43f23f74b97c6258ec040d846ad46fad481de5b92cb316e17fafdac5cb1e","ssdeep":"3072:OXLmVOrvZSrXI1/wWyNVfUWwjKyRHSnB+ymBJ+N+S87dyP:cGEvZSOYRN1/LDB+ymBARFP","tlshash":"f7d312dd571a0a9c225f2a1e2eb4c97ad87a150f3132d33883e8f2b5f5e358a4735618","first_seen":"2025-08-29T11:05:53.236617Z","last_seen":"2025-12-29T13:58:58.057583Z","times_seen":291,"resource_available":false,"data":null}},"time_used":4590,"timings":{"blocked":4288,"dns":0,"connect":0,"send":0,"wait":297,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/21954.1756903329400.57c97863.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.060Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/21954.1756903329400.57c97863.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-a3f0\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170385=wZL4fG/IgiVy5fExmMb/Ow0HDd89uzX2ljGOp/NtAhDUJCXdjoxMqpx40PbsYHRtZQcELJzO4Cp+i6Jug5CHfX6PodfeNhGUkRn/X/sabWolXc/0V20gYNvd0jXi6czAjYDEAXiTo6c7jbK5eVDYwKcKZwM61eCf/Q/LgkgdBoQjqSvcWMAHHLi1cdLBTwEK\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 5E7689FE-D768-4A94-8B3E-5B82B3B2AD74\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41968,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (41968), with no line terminators","md5":"e2c9f0777c63b333fc66af020ed0ef8e","sha1":"72714b7bdf899cc87c7399253e37aaa2a2f4487e","sha256":"0a2a1939d88947975b56974be20cb84a9c00f3c94cae6e057836b39aaf6b8c41","sha512":"fc02eb76f16f16c8a7346f72e7ac7ef4a68bca53cc7a5bb9f1e00b43f1bb002ca7847e2804be7d6bfe0713c3466210038acc4d5794bea5bec8f0190135f3e7e0","ssdeep":"768:DBPsaSfmzKrMdvf0eMQ/96loumY1PI1yBK9LudEz+yUy51y9y0yk6Dio+ILqpTeY:DP81R6Ipyk6o","tlshash":"0a132088fac2b06dd3eb7330857f505ae66a1dc0668c5438e260d6917e7198dc1fb9f8","first_seen":"2025-09-04T00:49:32.704767Z","last_seen":"2025-12-29T13:58:58.045079Z","times_seen":433,"resource_available":true,"data":null}},"time_used":450,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":449,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/9d72cdd5530c430a97f0e5c405f1472a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.506Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/9d72cdd5530c430a97f0e5c405f1472a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 2620\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1003\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"9d72cdd5530c430a97f0e5c405f1472a\"; filename*=utf-8''9d72cdd5530c430a97f0e5c405f1472a\r\ncontent-md5: fV8KQaQzdAuLp9RRvTl9Gw==\r\ncontent-transfer-encoding: binary\r\netag: \"FkGgxyoG3cgyf5twJeKAOB6TKImw\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:47 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 26rSejL7i\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: qu0AAACX0f-ysYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":2620,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 86 x 110, 8-bit colormap, non-interlaced","md5":"7d5f0a41a433740b8ba7d451bd397d1b","sha1":"41a0c72a06ddc8327f9b7025e280381e932889b0","sha256":"05d05c0cd7b92206398cab85226a94e72d05c2be727e6a459f09d854a086f3a6","sha512":"38c07c0f1408ba7567eb17961dac2ce795ce850b7752742350c1305bf8558b7ff4ccb64398c5b3b74df61fe66619751e3f3437e8dee87b3aea6c8af7a5497019","ssdeep":"","tlshash":"81511ab2185255fcfb67e64b03d03432ad27531fe8055c5a8977df4048a3551f58e3d5","first_seen":"2023-07-15T11:13:39Z","last_seen":"2025-12-19T18:58:52.013566Z","times_seen":10,"resource_available":false,"data":null}},"time_used":2610,"timings":{"blocked":1288,"dns":0,"connect":0,"send":0,"wait":1282,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/LOTTERY.4e81790a.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.811Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/LOTTERY.4e81790a.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 59689\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e929\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nAge: 51781\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 072A9016-BB90-4E21-85A3-A1253055DE6E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59689,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"f86c9671c7aed55212fe0eb5219a664d","sha1":"6e765dfb0ce3c646d8c808940071554e78e7d409","sha256":"4ba3fff550a17eff9585d6acbc4a96bd515149510f6a8bb7638985fb4b41a181","sha512":"706aa66f138a3459eaf34f5b7a8ffed3dfacecec6adf14a2e83f1149143cfbb059f97aaaac2032587a80c0e30c62e5b46b07b4dc6f3cf5925e6e1db2a8ed45d6","ssdeep":"1536:Cyp1EBaRnsFt9ZXZj0wEYsRvqm1waPbZsY:CLB+sFtzXN0w2ym1fFsY","tlshash":"914302f36beb0bc5b07adbcf4ed354f0067a71496b42dcd44f4120e61ea6199bac420a","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.458595Z","times_seen":2361,"resource_available":false,"data":null}},"time_used":972,"timings":{"blocked":668,"dns":0,"connect":0,"send":0,"wait":302,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_d991353f-39ff-4552-be18-848fc3fabfb2.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_d991353f-39ff-4552-be18-848fc3fabfb2.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 329516\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eNf8EUtWSixaUQkpBCPkQbjPtXVSBlOLsT9UOWsH%2FP%2B1P%2FMgNriXETNzwMpqMsii%2Bj2uATCba289s1LnOJlGnkecWX1dThOm8dZTA9o434cfZmh1H6ZLeqGNZCKc\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"6349b4be3bf7b45da5cc14ac341cc9f2\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:01 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48452\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047b0ddaaf84d6-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170392=LGK72/r9wLEJIr9d+AZ253CWHvbX8ozr9tp9MDldB5G8aPH3awDeFS2j9tUgnWT+6m8qQ6UEfWf72tWsi8ak8uWnSOrnl/zGOdYBljadFyiyDyDS5reeAt3jdpQhVvcane2SD+TGN1ytARChdlRlW1H4WIgzsqNovNrLQsAbv8/tMjhI6GXKOl4yva4aoW7C\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: F611DCE4-12E8-4A41-966D-77B90E5B7E21\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":329516,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"6349b4be3bf7b45da5cc14ac341cc9f2","sha1":"97362e5adce73ca7389eaf74b32958229efde267","sha256":"5684c9c66ee829f18a54d63c2ae5f50519c223e916778ac864e296f697e17647","sha512":"60dda27ed534d66d8de434fa683cdd74b9178abf1d703d8c215ce9955fec938bd79248b110e362b7a86d510203a749bb5584fa8ff660b009af7f492391c60fd1","ssdeep":"6144:QqXZESOr07UFOBtjljLtQ2n1WtWjmseQmOBzN7ivJNze:PKPr07kOBvtd1WAjgjOFN2m","tlshash":"f764233728e3d1be02e1f2b91098d5da0d3afc649795b3a3127699d80b9f9eb12030d5","first_seen":"2024-12-13T03:40:21.274372Z","last_seen":"2025-12-29T13:58:58.079672Z","times_seen":309,"resource_available":false,"data":null}},"time_used":4375,"timings":{"blocked":3474,"dns":0,"connect":0,"send":0,"wait":299,"receive":602,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/theme.config.a0ea1565.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.828Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /theme.config.a0ea1565.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-19ee5\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170382=fD3dUXvTAvqkKlHn3bIXCn0ldYgCieEWsInrTrUy2OYSNeSM3Ocx74L28Ir9Qu5IZZNTVdLIdSEvgdjLQMGdKY8rAwJgkpF4uDVhyWLRwemAIwfZs+oHw1mOuVEVgwYh/ydxqVefveJNFmABhM/gLFLt+3W80dYlTLRrtHmJoHD8gkh4JbcBxTMn6BGv6EQe\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 042B6811-13D6-473C-8290-5074FA28EDAA\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":106213,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (38260)","md5":"81c0ad2c8936f5f90cc4ba2b2e53366e","sha1":"8abbe251b908b7d81c73d8537d9d144d3ded3ff7","sha256":"61e7b259016e16c5f842da901c3b2f8202b73db878acb4366eccc217a4dc0b58","sha512":"f295e613097c68b8cb8d0a2530d07c3e883ffc75fdf6d0cd35c23040f1bb182401671c0f70781b64c97db7a37fe9d6d8163de658aef95ce9327ae0068afec7f8","ssdeep":"1536:D2JREob3mtlIRM4Sb2mc42mnzyJog9Cc0hM:qStlGu1pnz45HX","tlshash":"a1a3bb7ee20c963a6177a9bfb46ce111c12e9c0cab1d5fdef13e10a25710669c831de9","first_seen":"2025-09-04T00:49:32.985127Z","last_seen":"2025-12-29T13:58:58.024831Z","times_seen":440,"resource_available":true,"data":null}},"time_used":1813,"timings":{"blocked":600,"dns":2,"connect":303,"send":0,"wait":597,"receive":1,"ssl":306},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/31098.1756903329400.4108b3dd.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/31098.1756903329400.4108b3dd.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-561f6\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 4F67EE44-5F98-45CB-98D8-A88D6F239DE9\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":352758,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65338), with no line terminators","md5":"215815c091a19829f9fd6e5f28039f0a","sha1":"8ff2707b0ab4498bfd2bb7f99674b5a245ecceee","sha256":"06371440853645a0532df5edbbfd5c9e9661bec969aabc25b3353297c6f6574a","sha512":"34933b0388cddca0826af79fdd0f82c31c1264e87f004cd921360b19dc83a0ff188ac52a4de89427cc1c09f2785179fdf4d0ff7526d4a74a55f7971fa2738e9c","ssdeep":"1536:Ow+0YvC9jlTKAUSseG1SY46DCdlBBo3AgXOG9AsqCfCXsvCfCXsLCfCXsyCfCXsf:O/KK5sY4brG7O3SnLJNpL","tlshash":"1574b6f4c248c6fdea04ce0a7e7d6f2d50723783f2ec96c446aaf8865e91857245c4da","first_seen":"2025-09-04T00:49:32.813984Z","last_seen":"2025-12-29T13:58:58.029423Z","times_seen":409,"resource_available":true,"data":null}},"time_used":879,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":578,"receive":301,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1884x434_f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.080Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1884x434_f0600e57-43d6-4af4-8f1c-08ad10ecab8d.jpg HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WigeDNqGdpuW0m6VOle4pKK%2BGwi9FDsUsSZqWWVEPhjuylTzF%2Fkp6wEPiDGyyEP3XJyQpoRWjFS1UNd0N7o56Oymj3Jm9RUs3c4oyj7QPMG86y8frPCNqk6GDyqx\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"a66ab14232d9530ba56c6b3cf1a838ce\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:06 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 27382\r\ncf-cache-status: HIT\r\nCF-RAY: 9b0919ef38e184e7-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: C091C7B7-68C1-4634-A226-FBC81C882BE7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":396057,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"a66ab14232d9530ba56c6b3cf1a838ce","sha1":"7e1bd193a64756193437d09ab24ad5d6f9c1651a","sha256":"0baad519e4642a8a4454ae51b511aa61c9619a1825d1e5e29265e1009c0dadbf","sha512":"f146ae5c96ebc25388e2a67ead2f02256a7b49452031debe3ceea88efa07a1699302508dc2480641c2283786649dbad3d619a3eda67546e2180b2fe2179fdb54","ssdeep":"6144:RnkD2g7Xp2j6ic0qwwyN3TV9rOxsiitOVWkjtA8xsf5eCnqLhAi5iZS8fVSA:JQ7p2j6rxwwyNniM+WkjtAgErq18k8fV","tlshash":"668423b2c8fac94a736bf975649d99469024fc4f36df5cf9e1249c2f7602a32690813c","first_seen":"2025-08-29T11:05:53.269151Z","last_seen":"2025-12-29T13:58:58.048972Z","times_seen":342,"resource_available":false,"data":null}},"time_used":3974,"timings":{"blocked":2473,"dns":0,"connect":0,"send":0,"wait":566,"receive":935,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_1d28b817-0c00-4339-b666-213943a7b1d3.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 169448\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NCxHic6wkbnaJzg3S2hXV73qg%2B01Y%2FgB9bWbwaeUW29t3WLIMlsMNf%2BXLImH20lezczsUv%2FTeDFpzrhbt3EXJoggK6zDtMEXb6szv5SNS%2FM0mrpC%2BEcCtd%2FSq%2B6Q\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"8bdfc70c7f82ce44daf0fa05ad3eeaa4\"\r\nLast-Modified: Wed, 10 Dec 2025 11:50:34 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48460\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047aeb9e0a5ddc-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170394=Nz/+pSZmaO2C7uXGVyo7DBMkcXHGCcUuHmaPtLTQSXXLpvwIEjYbRDsDBkLOVqPuf9OO8cBm2gBYUxJ437Y8TlbdnSLR8QRLsz+VHrr7fKeAWVvF5ScDjC1Xk6Vq6nfHSdhffhfE9vkWD6cxZKtT1AJGoe4WIf8+VJGatPaoUEhG6OP8V/thIabrnWnKspXM\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: E5464D77-798C-4972-8FFD-D35FB04471C2\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":169448,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"8bdfc70c7f82ce44daf0fa05ad3eeaa4","sha1":"28324ebfd2786e353a9d8fcaccc4f0ac799d7298","sha256":"4a6a0f4743ce7322265461bcf5513b75300ee02a0e0fa99c6ed52504257ab386","sha512":"c42e0688880255c76f533517731cf5e26c7804903f62d67dd3bde71534051930144edd77cf3cd25bac6c7b5ccca482a824f3e949b75d7e1ef933673b39bfa9eb","ssdeep":"3072:vWQAl+XOeoZ6HUR1uhhITVjmrDOukWh0CX6zcAds080pWiCOM2aWLS:OYOeoZTR8UTutkVCX6zddVzMFWO","tlshash":"73f312c591b38ed687632d78cb44a2860133ef127968d9ed412c84bdc9ed2127cf48fa","first_seen":"2025-08-29T11:05:53.114202Z","last_seen":"2025-12-29T13:58:57.992421Z","times_seen":294,"resource_available":false,"data":null}},"time_used":5555,"timings":{"blocked":5255,"dns":0,"connect":0,"send":0,"wait":292,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/eca168c2ea814613b28fcefab79bdff1?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.429Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/eca168c2ea814613b28fcefab79bdff1?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 3517\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 6533\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"eca168c2ea814613b28fcefab79bdff1\"; filename*=utf-8''eca168c2ea814613b28fcefab79bdff1\r\ncontent-md5: B2IVSj/bI5YjIJNi1Tw2Rw==\r\ncontent-transfer-encoding: binary\r\netag: \"FkfVM8GLf1xBdMlwf4_3XDR14hea\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:21 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: hfvl2szOi\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: JqwAAAA4SX2rrIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3517,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 150, 4-bit colormap, non-interlaced","md5":"0762154a3fdb239623209362d53c3647","sha1":"47d533c18b7f5c4174c9707f8ff75c3475e2179a","sha256":"2db161be6d898220c43025aa468eac7ae13cae265e2e3e52f1e33355ca6f06b8","sha512":"d438f66d5ec8eedb352591d1f0ec18feaeb94613709cdfa7ce597dc22f85174e07beeb720ced94a49173969ed9916647fd7afffb1633eae7f45bb86ddf3139d3","ssdeep":"","tlshash":"d7716b8136cdf1b8e8352ab95c1ca013e5bc1303f4249309232164538b9b3aee9742fb","first_seen":"2025-09-25T15:34:22.08965Z","last_seen":"2026-08-09T16:57:47.791165Z","times_seen":57,"resource_available":false,"data":null}},"time_used":4452,"timings":{"blocked":1612,"dns":635,"connect":255,"send":0,"wait":1057,"receive":164,"ssl":726},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.586Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_392325e1-efd7-4953-83f1-410dea55a03c.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 80779\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=c%2FQHSWTPk5KV09awu7nnlkW6fJ%2FB9vOpTQ9aSPXnSQ1g%2BoNXumYjmN6vx60AdwFv%2FN8FXw9j62AkgiPprOk5kUNqL1D9tfPk7eRcalkUVo%2BngXJaM1%2Bj5rgG059y\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"4c5942d2ff7143f561ab601251f4fd8a\"\r\nLast-Modified: Tue, 02 Dec 2025 14:07:21 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48475\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a7f4b835df0-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170392=LGK72/r9wLEJIr9d+AZ253CWHvbX8ozr9tp9MDldB5G8aPH3awDeFS2j9tUgnWT+6m8qQ6UEfWf72tWsi8ak8uWnSOrnl/zGOdYBljadFyiyDyDS5reeAt3jdpQhVvcane2SD+TGN1ytARChdlRlW1H4WIgzsqNovNrLQsAbv8/tMjhI6GXKOl4yva4aoW7C\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: A70B5851-71C3-4A38-8C4F-9722B9925C79\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80779,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"4c5942d2ff7143f561ab601251f4fd8a","sha1":"33992d6c0f6b7cfd15c10b89cc21d6e61b388b9e","sha256":"930520faaba7720398434d06b0cdc67819d0bfb174db13978ea1df7f95fe2c19","sha512":"a8fd398b0dce4c041f2570df3a1be5d46766e8206a82c53c78ea7bf19fb22bddbf465acc1df277200236b58168149cf7101698f416ab9f763406d09d5e0b343b","ssdeep":"1536:THVzFXmHVHAZWTzvtRHxFyUBlN+f3LkQ33zIVxWDmI3Ay3/ntH8:TDWg4TzXHxPS3L9zIVxWCob/tH8","tlshash":"20831231929bf246f092a3b6fe3a5165181cdd60dfbcf58b8d5e4e281d6b2c1820dc97","first_seen":"2025-08-29T11:05:53.231567Z","last_seen":"2025-12-29T12:28:25.243317Z","times_seen":307,"resource_available":false,"data":null}},"time_used":3989,"timings":{"blocked":3695,"dns":0,"connect":0,"send":0,"wait":289,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.601Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_bdd30f19-a4d8-4eb3-b2d5-d24180d2e353.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 26169\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7TdjMJObhljQ9FGPIP1bSe%2BHmH8Zm6aNmxcri%2BkauqERXmfIpcys19tMhMyIBE4MrVhCM5YRiSddXIgpY2yL4yJwAvFXfMOaPO%2Bgo22da0pv0bj%2FUtIXauUTSKxZ\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"8e4798de63b7a1ed460a9dceb8477da0\"\r\nLast-Modified: Tue, 02 Dec 2025 14:16:45 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 51767\r\ncf-cache-status: HIT\r\nCF-RAY: 9b042a26aa2a8536-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: F3AA353D-2C34-4DD4-80AF-139A0017E537\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26169,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"8e4798de63b7a1ed460a9dceb8477da0","sha1":"63fe754ff17c8577556ed86c83fb71d48741aa86","sha256":"cbbb80241f900ee2edd463b57c36b50acdaf20321e3b134aa03670231f3894dd","sha512":"998c6cad3e6c77429ae6f521b1747c47d9285cf28c06418178afd2fdba96f12e57981580a0acbc7995a618b87d81f90caf4d550da0abd637ac3b8016887d1814","ssdeep":"768:PU86xxR89xObVIibTCjG7U+6tFMAHgNDtn6Jnan4bYPT7:PUfk2VQG4LFMAahOna40PT7","tlshash":"6ec2e12706d74fd99c67667ec399c4e833b013347334e2908777cd26c4d968a88a0eca","first_seen":"2025-08-29T11:05:53.252109Z","last_seen":"2025-12-29T13:58:58.031108Z","times_seen":302,"resource_available":false,"data":null}},"time_used":4615,"timings":{"blocked":4296,"dns":0,"connect":0,"send":0,"wait":318,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_f26e0b0b-19a9-470f-90cf-ab38984671ab.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 163087\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qL%2FDEmQF4zyaFwX1UISO8y88zsw%2F6XA2y%2F7Ve%2FtT1Kk0mKbe2E2uFDza00wqwz4jhTxz6v7o61Q%2Bwjl96lh080Q%2B5FOW0Ps3lKEwNP6wWarHs6uLYkG7Jxb8eWAJ\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"665f9e6ae0a86d0eae47cb8dff17bae3\"\r\nLast-Modified: Wed, 10 Dec 2025 11:50:10 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48459\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047af3aebf850c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170394=Nz/+pSZmaO2C7uXGVyo7DBMkcXHGCcUuHmaPtLTQSXXLpvwIEjYbRDsDBkLOVqPuf9OO8cBm2gBYUxJ437Y8TlbdnSLR8QRLsz+VHrr7fKeAWVvF5ScDjC1Xk6Vq6nfHSdhffhfE9vkWD6cxZKtT1AJGoe4WIf8+VJGatPaoUEhG6OP8V/thIabrnWnKspXM\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 6B20A550-4B98-4E80-94AC-06B66A5B5DE7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":163087,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"665f9e6ae0a86d0eae47cb8dff17bae3","sha1":"dd7600af4c65b5bda644140616ee4d76ac1795da","sha256":"caf741c67c08cd0c8291a16caf42ea1d9830283434a62be24fe1396f1bd21dc4","sha512":"3a8ed0a038a0089a590a989397da4b147781ca6aa99daef06344686e38bd3987772fce673345007dd6bab344d3719ecce0d75649355eeb8f3474cdc8aa78f5a7","ssdeep":"3072:f2ERsjJw8K6/iWw8B6ssU9m4QkMyu6IDLWuDboEfXO464gl3omZ1AU/eoIOff4e:f2EeFZ/aW6c9bszDCuPo+XO461YmnAiX","tlshash":"21f313d848400afcd04349fa6fa09931c3b17bcf53d9869afe8c63ae5d49964bc1568e","first_seen":"2025-08-29T11:05:53.303219Z","last_seen":"2025-12-28T07:17:25.238253Z","times_seen":289,"resource_available":false,"data":null}},"time_used":5770,"timings":{"blocked":5473,"dns":0,"connect":0,"send":0,"wait":289,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/assets/logo/favicon.ico","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.460Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /assets/logo/favicon.ico HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:05 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 58278\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-e3a6\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1766170385=wZL4fG/IgiVy5fExmMb/Ow0HDd89uzX2ljGOp/NtAhDUJCXdjoxMqpx40PbsYHRtZQcELJzO4Cp+i6Jug5CHfX6PodfeNhGUkRn/X/sabWolXc/0V20gYNvd0jXi6czAjYDEAXiTo6c7jbK5eVDYwKcKZwM61eCf/Q/LgkgdBoQjqSvcWMAHHLi1cdLBTwEK\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 7C71E654-ADA8-4A51-BC08-0B9F8073B8E9\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58278,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"7fb9203f2701deec1371d2fd0ddd079a","sha1":"a7d4ea5f1c3d103aaa3c078bf540b56404aec0e1","sha256":"2a342dd0f9977afb12227889cf13ff008d4cf1e9a4ca07fb4131d14af05978d0","sha512":"964cf7794a7b72bb9515927efe748563b6d46fe122b35baa4c7f57fafb09ea759e5e759a3000d385872218cdd08383a58a2b66feb9a712e6f3e9a06cc87e43b5","ssdeep":"1536:e7V6OVB39Hdm34GeF4KERayBlZ3WgaOlblY4+:e7V6OV7034GeFERd3WgaOlbGN","tlshash":"af43f10a258e86c73047c3921b2dc09b70d12c776b8daef9e6bc4a5816d54731bbd1ae","first_seen":"2025-08-29T11:05:53.165834Z","last_seen":"2026-03-18T12:35:38.966648Z","times_seen":1201,"resource_available":false,"data":null}},"time_used":654,"timings":{"blocked":138,"dns":0,"connect":0,"send":0,"wait":478,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_79864bfb-d71a-4513-a524-8823b86ee01d.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 87818\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tX1fi1HndCfgWmFzRyx%2F2PG347SxnHr3YGCfcbFWLJE%2Bc2zN1VYDL%2FqiqSassF99dcH8xVS7gBhR%2BHeTQADn6pl4nujMsoBE11PZzUKtX8RfPGXBEhQ7qdJITVTQ\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"aa6fecf1d92393ed340d8ecf5eb30180\"\r\nLast-Modified: Wed, 10 Dec 2025 11:50:56 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 51768\r\ncf-cache-status: HIT\r\nCF-RAY: 9b042a269f6a5de2-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170394=Nz/+pSZmaO2C7uXGVyo7DBMkcXHGCcUuHmaPtLTQSXXLpvwIEjYbRDsDBkLOVqPuf9OO8cBm2gBYUxJ437Y8TlbdnSLR8QRLsz+VHrr7fKeAWVvF5ScDjC1Xk6Vq6nfHSdhffhfE9vkWD6cxZKtT1AJGoe4WIf8+VJGatPaoUEhG6OP8V/thIabrnWnKspXM\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 522419E7-B0CE-464D-B5A0-9D1A834F9D3C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87818,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"aa6fecf1d92393ed340d8ecf5eb30180","sha1":"c253c4066e99708b3af4c91c8cb87f5500b9e14a","sha256":"802eb202e21b02b88c529fcfab0745795ed573a9d1a623f06c64730ef1424bec","sha512":"a2bf6e88728516abb6b6bc3c7b8475ffad41d7f8a1a3420bd00a853256faab18f42b8e358feb7194a7d5f4e327753943edd2d784ad489a3f6464ba3dfaaf8a7d","ssdeep":"1536:kBPumsnGpw4JOOR/fiF4kRtopUtzjHjt/UEqVo0xrQiGkw88TpGwB3EVchMbYi+D:k9AmJOyHOqUt/XWoErQi/wywB3miDz1d","tlshash":"bd83121fd6c96f65d8d871fd28e8734298add1835ed12e43a001a7e88f498f0a027ee5","first_seen":"2025-08-29T11:05:53.090923Z","last_seen":"2025-12-29T12:28:25.260601Z","times_seen":296,"resource_available":false,"data":null}},"time_used":6352,"timings":{"blocked":6060,"dns":0,"connect":0,"send":0,"wait":289,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_0fa85f10-2205-44f2-82c2-66bd141c7d57.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.630Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_0fa85f10-2205-44f2-82c2-66bd141c7d57.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 98966\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rDLyY4DBT6dzndmeWWtoGMI9SLRfveeznyVFxyeUpSLv6P9nX9IGw4z3DISANv2dd7iouqs0xQWk0%2FAkxo22gtDB28P0ilzNkLfc4n4ZcnmHrp85l9i3OhOsBA%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e3794a26da2fd77c7af0c0428df5c184\"\r\nLast-Modified: Tue, 02 Dec 2025 15:06:58 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48485\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a530f3d25e5-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 2499FEC4-DA47-4D87-9D63-B1B394ADE376\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":98966,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"e3794a26da2fd77c7af0c0428df5c184","sha1":"5d29a91430da448ff8667bfec530c5b46f344ab6","sha256":"acd5357de808116b14225d259667f948557549868bf6a3689737f99462c19adb","sha512":"d97a7b18d9201cb3c481efcf5a18032fb5b433974be0d076560c09e94a2643476a96ac08793866cb98b1ff61e47453a9006851f64b2a2a6b50acec94c6f1e43a","ssdeep":"1536:Vvz41FTye8ysQW30ZMmB7mKkblC6U5Jm1vOxP1vRNR+vv7Q+IgyLQmvFGQgRudOr:S1F9K3a0wbJmMvRLyv7ijfgRudOr","tlshash":"d2a302208b697423cfdf04ae550674b8e56cf67fb5ba1d1248be318c219bd82d6fc852","first_seen":"2025-08-29T11:05:53.224762Z","last_seen":"2025-12-29T13:58:58.034703Z","times_seen":288,"resource_available":false,"data":null}},"time_used":7232,"timings":{"blocked":6937,"dns":0,"connect":0,"send":0,"wait":289,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/52388.1756903329400.521cb32f.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/52388.1756903329400.521cb32f.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-6b1a\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 69EF7A57-5728-4FF7-91DC-3AD37308AF59\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27418,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (27172), with no line terminators","md5":"cdd31eb0b7ccfc1eafcead314123dfda","sha1":"2bd4708c1e30cebc08cdada8ef890baec6ef8622","sha256":"669b207d5cf11b0e229699f6e54104836b252c5398e20c4bb564b89b2525f0a2","sha512":"9c48059df23c4a9632eed22a28d883786e40c593fe3ffddb9144fbca21a45322121e36580084fc642e9058f086d3657d819f5d2b9528a91633aeb2085cd5ff06","ssdeep":"768:f9Vl3u/ffsp3aNWchZ4IIATAJ016fkmD19mprq2xd7QjDv1gyT8CpYCVc5WsNiU:8308O1cq2TlW0","tlshash":"84c20a80d6b4f5fd636ec9ab8a3a8464602637c5b0c8ace095ec6e8c3d4475774788fc","first_seen":"2025-08-29T11:05:53.257205Z","last_seen":"2025-12-29T13:58:57.988641Z","times_seen":422,"resource_available":true,"data":null}},"time_used":456,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":456,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/left.34013cd8.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/left.34013cd8.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 237\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nETag: \"68b83893-ed\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nAge: 51796\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: AF6D1AFD-5F4F-4198-9452-F4FFF0A5BCA6\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":237,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 14 x 44, 8-bit colormap, non-interlaced","md5":"5ecca260da6fc5e2843405c20ac69817","sha1":"3918cfad7493b6860ded9e259ba90bc6a853f1b1","sha256":"078a4aac39c49a33cbabf23cda7579fa7b76e875e6b6d24d16cfcbf9f8b250df","sha512":"b76a870a79a87a450e5d30a218d75093b57415c563e64a8ffd6839a31b36379dbc08398698b9c1368ecda671d65045d5cfebe3363b98d746d89dcaad15bcd8ce","ssdeep":"","tlshash":"6dd0a99be2076faed1c70bb3732e0ca18a8124e892944b088042c622ca663a1dd82042","first_seen":"2025-08-29T11:05:53.221032Z","last_seen":"2026-08-10T17:58:48.26878Z","times_seen":2635,"resource_available":false,"data":null}},"time_used":2044,"timings":{"blocked":1739,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.736Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /ecb/8f83064248a6651521ab9b26970d60fa83f0bf5f79fe68600101b67707c272184849423924c3e9832923a30acedcbfec8ac50fef89fb HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://f214n.xyz\r\nXign: goLbrpHwF/Hjvu1XwuxODcJlLCn93X5QHHa4WXBYj7cCR12RIPk3MpUmVcs3FBNh3YStE7gwPhF0TPgcg+LuAKb4xBsNxWcFxwCOuArPAUKqLJ9YBiYjN0WEsS87FqZtbQDWguej3dpm6FQp+KsBuesuSwpnwASBcuIEYdkXwOc=\r\ntimestamp: 1766170386705\r\nsign: 06fk7qpr4k397j43\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Fri, 19 Dec 2025 19:03:07 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 153971C1-1B78-4DAB-9D0C-08AE1A5A4081\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6563,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"58a49ad3a052797d55924c6ffa4f2787","sha1":"f65c0ae9ebbf9136a415d678a05ac88d70a8f7c3","sha256":"7dda13815fab209c2e5165c45666b9b678d3943291a98d092472afda90516bf2","sha512":"1bbe421ef525bd4bc2baff7f4ef84acd6b371029aee7d9e5b8fcc900c23e3dadf8aed616c2202987306c6643a876fcca5cb0a18cddb62257a9a3140b25a30d04","ssdeep":"192:V574MX5sJUK+Gm4ZQzX2020pUZfiza1yPFVNWmmvYh4aVNma/9HLVooM:rUMXAUahe2kUZkyyPFVNGvy4ajmglVoD","tlshash":"c11290134204f7c3a1b7cab6ec2148c4398967f6b9e5499ece98e7f6053b242d70d58e","first_seen":"2025-12-19T18:54:13.72248Z","last_seen":"2025-12-19T18:54:13.72248Z","times_seen":1,"resource_available":false,"data":null}},"time_used":967,"timings":{"blocked":523,"dns":0,"connect":0,"send":0,"wait":443,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/38026b46af8c4779b61a3e8f95459b01?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.589Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/38026b46af8c4779b61a3e8f95459b01?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 56212\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15786\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"38026b46af8c4779b61a3e8f95459b01\"; filename*=utf-8''38026b46af8c4779b61a3e8f95459b01\r\ncontent-md5: iHt2Y6DUcDFSiSHZlyrjpg==\r\ncontent-transfer-encoding: binary\r\netag: \"FqJrTj9n2wqOhcqA2clNKivzyyW8\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:20 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: MWWwsl8Tv\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: bvwAAADY_jdBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56212,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"887b7663a0d47031528921d9972ae3a6","sha1":"a26b4e3f67db0a8e85ca80d9c94d2a2bf3cb25bc","sha256":"de5d2023c4cb1bb33b8c23d14cf68ec627f19396612d87a3bee1045574970d26","sha512":"6f9527c7d3e6ea46cab0ea9a234d09ff4118fb6fb6ec3bcbe4b0c528b0bf073cc874cbc77a04385c5d5ff76025e4050c06288a4c9891dff3705a72d530d6a902","ssdeep":"1536:Rk51KVCXxvQ0W1XdhwFedUwbhNuK3NNvgcgqJyU0t:RooCZQ0AXdhZeytdNvg+Jyht","tlshash":"d643f196f054961623f748fc860a6cea7d6914c78fd04460d0df628e4fe3331aa6dea7","first_seen":"2025-09-27T19:21:32.748857Z","last_seen":"2026-05-15T23:42:44.555737Z","times_seen":250,"resource_available":false,"data":null}},"time_used":3217,"timings":{"blocked":1207,"dns":0,"connect":0,"send":0,"wait":1288,"receive":722,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/22d48e3f0c264f5fa02c3a1c74d348d9?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.632Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/22d48e3f0c264f5fa02c3a1c74d348d9?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 74924\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4970\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"22d48e3f0c264f5fa02c3a1c74d348d9\"; filename*=utf-8''22d48e3f0c264f5fa02c3a1c74d348d9\r\ncontent-md5: 0yBfPdygfcAcgi6g3iSg5w==\r\ncontent-transfer-encoding: binary\r\netag: \"FiO5s-p7mJPv1coJcoScJLUvas5-\"\r\nlast-modified: Sun, 14 Dec 2025 19:03:46 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: c7lPQbtwA\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: h88AAADaJX8XroIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74924,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 290, 8-bit/color RGBA, non-interlaced","md5":"d3205f3ddca07dc01c822ea0de24a0e7","sha1":"23b9b3ea7b9893efd5ca0972849c24b52f6ace7e","sha256":"2ee13280fa78e6ae28fb3933f74580cbdf2ba282b52bbfe225b3f8bd59cf3326","sha512":"716c48f62f178d3a7839849edbdbe689d774458fb488963738269112cd4f38209ba797c94db530e8b09d08f630fd651c6e40fd801a6418b375f9811d8c914581","ssdeep":"1536:pX3xBKQStnYlD/8MZy9Qvcs5ETo9O4A62vlXJikzqJrmIprbDLXW90InQPQ+:pn+HMD/BvHERJikz5eDzWKInk","tlshash":"a273028f0056edc9c63c7eb190732d5a276aa8d576cc36e2813c44c13a65db8368cfa6","first_seen":"2025-01-07T09:47:10.035395Z","last_seen":"2026-07-29T13:04:06.223506Z","times_seen":241,"resource_available":false,"data":null}},"time_used":3319,"timings":{"blocked":1170,"dns":0,"connect":0,"send":0,"wait":1296,"receive":853,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/home-bg.1e09954b.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/home-bg.1e09954b.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 4014\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-fae\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nAge: 51775\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: CAE7DA06-016A-4D1D-9FCB-F862A7F39733\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4014,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 278 x 80, 8-bit colormap, non-interlaced","md5":"ed0eb6c81f949885511fbbe4d666a2f0","sha1":"d74fb98c3b01727753bb182eb5ee5d6eedf3da4a","sha256":"7fecf4ed61ab1535aafe2800474ac643b49264b83f54fc1da596d7334868ae75","sha512":"dd2f749e24e6b35f80fa77856c9c8b1cb1e0cacb9250b947403283e152d8bb9e7bf539df00ca6743d4162aeac014e47ce82191b62847fabe6cbb5693b4cd7fec","ssdeep":"","tlshash":"1a816c7eb31a4997296ff194138b387d74b0709d0b546934388a9c31a4791fcf39e526","first_seen":"2025-08-29T11:05:53.155399Z","last_seen":"2026-08-10T17:58:48.423629Z","times_seen":2359,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/css/64906.1756903329400.0ab0fca2.css","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.682Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /css/64906.1756903329400.0ab0fca2.css HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:05 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-1439\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170385=wZL4fG/IgiVy5fExmMb/Ow0HDd89uzX2ljGOp/NtAhDUJCXdjoxMqpx40PbsYHRtZQcELJzO4Cp+i6Jug5CHfX6PodfeNhGUkRn/X/sabWolXc/0V20gYNvd0jXi6czAjYDEAXiTo6c7jbK5eVDYwKcKZwM61eCf/Q/LgkgdBoQjqSvcWMAHHLi1cdLBTwEK\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 237896C6-1478-448C-99FA-AA518BE44CF2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5177,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (5177), with no line terminators","md5":"a0ef4268641ef0b005737ce8cc0c4b44","sha1":"9bb50b9000a419e7a701392b0d7d6c992cf585bb","sha256":"f64c7a7e6ecd620d1c7f8cc67e1eda83a0a115a8d86f3954efdaba3c09d62e66","sha512":"07605ebd7e16aef28f0ad5ed406f29ea9b77e8ba6b2079c810aacf8faf0b4a8d18d4f7775c62860cbf6d4379729a60076103a4daa833c860ddebeee3793ccbe2","ssdeep":"48:ZSPkOO2s2L5Pukasq+nArLkrL4QuQKhUjUkM5P6CdRDRWURcWaTHR/:iOvyP2r4rEDFP61LR/","tlshash":"d1b1412f01703349641bad6807dc67098325d8b399eb37da259d2a0dcbc3f861eb718b","first_seen":"2025-06-26T16:31:28.933081Z","last_seen":"2026-08-11T10:23:49.12464Z","times_seen":3741,"resource_available":false,"data":null}},"time_used":458,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":457,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/api/tenant/domain/list","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /api/tenant/domain/list HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nx-request-source: https://f214n.xyz\r\nXign: pgeIooTvmFBkS3MqKkdTNKd+J/qWQPRrLHRenrHZemxwnzKtmU00Zm+j8cnq5GD+Anig67Uty/wOPdLS7zbSuucWdUoHkQ6fatWJ8CRXfM9Qjs6nSrvH0QmFBjunMSyGhZvSVVkAwmM+Af8NwDY0oOucv/BsT2ATnrQyHdq6GSI=\r\ntimestamp: 1766170386724\r\nsign: 621l385s6m4b2b5r\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Fri, 19 Dec 2025 19:03:07 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nVary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nX-Content-Type-Options: nosniff\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 50FA2666-F009-4F3F-B996-18DBFDD2D342\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1108,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5d9e96bd132a2c24281ae50f2b09efe4","sha1":"503ea18100d0f1573baa195933355a1372e93841","sha256":"7f205b18b5deaae96622989dbc8ad73999a9616e96ef26d909f19525deadb328","sha512":"ab5a589dc81944d2fe05d656777e9e490d42a2fd68c7e577387cfdd47c9b0c5276ca2f91a3868407c373e500d00bb5360a5ae035c7c0cb1addf47f20755a268b","ssdeep":"","tlshash":"fb11c6101c6f12c8d6e8d29263503345388d8b76056db91b69d6b74fae0583a32120a4","first_seen":"2025-08-29T11:05:53.144028Z","last_seen":"2026-08-10T17:58:48.488784Z","times_seen":2669,"resource_available":false,"data":null}},"time_used":983,"timings":{"blocked":551,"dns":0,"connect":0,"send":0,"wait":432,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/ce427b47f4b64ef799ab2d28d6da12c3?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.624Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/ce427b47f4b64ef799ab2d28d6da12c3?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 93153\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 6773\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"ce427b47f4b64ef799ab2d28d6da12c3\"; filename*=utf-8''ce427b47f4b64ef799ab2d28d6da12c3\r\ncontent-md5: s+Si+Db/6HMBl3r15PvPeQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FuWU8wwEEDIP5LmYfIwEhAomDcJF\"\r\nlast-modified: Sun, 14 Dec 2025 19:03:18 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: m5yqiSaUi\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: OboAAAAcspxzrIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":93153,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1200 x 1200, 8-bit/color RGBA, non-interlaced","md5":"b3e4a2f836ffe87301977af5e4fbcf79","sha1":"e594f30c0410320fe4b9987c8c04840a260dc245","sha256":"695909ba2c448d3554b289bc51da3bd7a49e25a2f78ff79cf45d147f1453d595","sha512":"9bccecfb1225ba9407efe66981891336cea3a5b861b8d244bf27539365d0c27f84a46b05bcdf89b3b2aa524b4efbc31e811761db0c26516a6e2688f3f452c2ee","ssdeep":"1536:86SJjrhLjquNk9OrLZQMLx7SRdqw/Uzrq7dFyujMhfx0d6jfU4EW7+6shyZqS:86AJ6ukAvmIwRdn/Ori3yrjs4+6shHS","tlshash":"5d93021314dc7c45c389c572b08c4ce6fa6907fb4880bf755a323975dadd92a8ce2c96","first_seen":"2023-10-31T11:08:24Z","last_seen":"2026-07-24T14:13:39.328599Z","times_seen":320,"resource_available":false,"data":null}},"time_used":3318,"timings":{"blocked":1178,"dns":0,"connect":0,"send":0,"wait":1291,"receive":849,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.614Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_13f1f273-ad7d-4854-b9a3-7f3eb8823296.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 147613\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=meoOdh7yAkugBfuZO3ROHwIdL%2BXeV9Fi4oou8MGommzBhJy%2FsOHXxGosn2QRylay4Ll2bf0y6wQ9B3NG14i9z6%2BuEVYCMRG4FgoO3h4tNDIDzOLHyvlF%2FkxZVPCP\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"1af1a4706ec456f37c4354214bb5397b\"\r\nLast-Modified: Wed, 10 Dec 2025 11:49:48 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48478\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a718e28d44c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: B2A37236-4894-45CB-B387-4258A1D8AB2D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":147613,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"1af1a4706ec456f37c4354214bb5397b","sha1":"d4598a9b6373a24fa251d1326b973cefe08e7a7d","sha256":"de9a8bcaf7e6624d23a8f8415ea12a9ba8d103f977fabbccb6ae571671dd83d2","sha512":"f0526ef7d091b072d78284fb8011400651f5f7e9472ae9fddbf272a51e5d6d60a8df34fe85134d4a54d91c61a21dec8e862a338096beea33eef944daf93152b9","ssdeep":"3072:wpjsS/+EYEXoMenKagm4TP/DImKbojBuxcpGtBoWrYRMv:LS2tfgm4nI8UxXBrYq","tlshash":"f4e31204f52a98e2cd960db23b354cc149bc5e980a4b39e5e4c3d677644725adaeb2cc","first_seen":"2025-08-29T11:05:53.134299Z","last_seen":"2025-12-29T08:12:31.364681Z","times_seen":298,"resource_available":false,"data":null}},"time_used":5521,"timings":{"blocked":5217,"dns":0,"connect":0,"send":0,"wait":298,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.643Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size750x590_1103f977-5f3c-414d-8305-ab6884e8769c.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 79714\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fQYGhPf%2BU0MpM8BuS8yRe35CpsOn%2Fcms9jG000EdWz4n%2B%2FTIhaOIS8u6AqRA18h9yMAvbQheU9dJhV9xI23Kg54Ib0luMOBvGPY47YXQwr3Rabu%2Fvx1rTpqkyw%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ef17ab9ddd63b4c656b2b32b64dd5cce\"\r\nLast-Modified: Sun, 09 Nov 2025 14:30:01 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48474\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a9e691b6ad4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170396=4SkrsUSoW8B3phE2Wse/QgXyN9AZhS7w9ObfuAIkP6rYfORomPSS+kQV1rAbREOB4yWOtpH7eXlsvd6OOs8mKMhW5hce4rh9MEkd9H4Bh9H7w8kQNMGdjlTPEVj01bWPsAbErnbj0jGPhZof+HAx78rmv+yV3MEcz8kx7Gt3i8HP8JC3ceg3xhIKk/15cbGe\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 0412FA10-FEAA-40C2-AF42-65520FCB024F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":79714,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 750 x 590, 8-bit colormap, non-interlaced","md5":"ef17ab9ddd63b4c656b2b32b64dd5cce","sha1":"7ba556d00dfb16b930aad4b1beaf8aa53da162e7","sha256":"420e21a46c35f4347e767d170b68460bc95304b5ec459cabc107e85980c6af0b","sha512":"c9db896e40ab968a297150834286016a08b8ca93b4ebb35e1397f4021fcc2f7b8bad6e5c4e21e3cb916b72a8c31862c0f9e11302d3059b4c02cea4b55c50591a","ssdeep":"1536:IkxOWEsKXHidS1bbSZ5ReqcL870XVwdR1++xXV+dU2GUlj1ksKU:IkgWEsqCdSlbSZ5ReqcLbXCdD++3qDLT","tlshash":"7d73023d6288b7bee034ff7551d1137641b18daa5e41eb0ecf5082652862ffa2c76c49","first_seen":"2025-08-29T11:05:53.078061Z","last_seen":"2025-12-29T13:58:58.056612Z","times_seen":292,"resource_available":false,"data":null}},"time_used":7587,"timings":{"blocked":7285,"dns":0,"connect":0,"send":0,"wait":298,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/logo/logoWhite.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/logo/logoWhite.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 6364\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-18dc\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170389=idzLU/VnowglBgoqJE8E87wM7N2x/XjzHcgPl1shS4I1xcQPPmlzEkFuT2xu+AD7F4ZtTRdDfIH9Us1jlpRGvwS2rGSsoDgxnfRyd3GWrGiywCS9NNen0IIc+8Y2KMwSzT/mRYytP7KLkipz1SkQ2QNVsFqqQ7BWDLeOVIU+W/pttwEmcpHTO5VhtAMg9t42\r\nAge: 51798\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: B9DA7D8F-D81A-4D90-B812-DB5C7CD02F75\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6364,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 318 x 144, 8-bit/color RGBA, non-interlaced","md5":"45c781dc22fa33ee3af4b9611b40208f","sha1":"85005a42a66ac2755af868d974cef7a96b3f7732","sha256":"992d312ebba7a4f7559af9b559b803b6de8be4577a26366c29066d98bb382428","sha512":"63a95d0d966dd41d636bcbedda1763579f8126b7ae5448c3f8f350aba06b05dbe81d9f615833f0bbff34bfe341c6f206a89e145ada9acb28945131c816ca8094","ssdeep":"96:T/iMk0vyTGRwuNomrrhXoC4P9IdsLM1hhpMUWBg+TM42IGWUp9PXtQJ1mTdAcsor:TqMkud+wWC4VNyhhpL/+yzV9QJM+4","tlshash":"d5d19e4301c5b55102d0521645ba005b6dfb6be0bedcc40aa497ef0609313e6fef75d9","first_seen":"2025-08-29T11:05:53.141975Z","last_seen":"2026-03-22T22:11:35.376909Z","times_seen":1124,"resource_available":false,"data":null}},"time_used":3855,"timings":{"blocked":3564,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/84e3bdc1d8f24efa8a8474a04117f379?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.427Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/84e3bdc1d8f24efa8a8474a04117f379?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 8041\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 6532\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"84e3bdc1d8f24efa8a8474a04117f379\"; filename*=utf-8''84e3bdc1d8f24efa8a8474a04117f379\r\ncontent-md5: COhPKRpi12oGcb+wkWk8tQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fg_7hU8ox4iUmg6CgwN01fkReks0\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:20 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: R6fAWSMEc\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: ZDkAAADscXurrIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":8041,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 99 x 99, 8-bit/color RGBA, non-interlaced","md5":"08e84f291a62d76a0671bfb091693cb5","sha1":"0ffb854f28c788949a0e82830374d5f9117a4b34","sha256":"c9075a6a6464033ccac5439fd80c56d9ac983e1acb49db857792c2c2df19e6dc","sha512":"3d6f51251386b8369674d6d74472ca03d6b5f51c172af6708dc17b569d1b8c514c9927ac850e715092953b5779eefc14ad98540089376f3b0b37765d6931bb3f","ssdeep":"192:VnnnnnZ7FEUeGbmkb3ts8b6kzqEzRrHIlucE4I4BXcHHlCWrkOKnnnnnn9:L7JBmk5DbH+EzRroIFCWw7","tlshash":"ccf1b0dc12be033c994b47e9a9563633175e6b71ec35591490e77f289f86d1e7c01020","first_seen":"2023-12-11T12:53:02Z","last_seen":"2026-08-08T01:43:15.210059Z","times_seen":52,"resource_available":false,"data":null}},"time_used":3010,"timings":{"blocked":1365,"dns":637,"connect":252,"send":0,"wait":272,"receive":1,"ssl":480},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.572Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_07a2d840-d1e1-4217-9d3b-badf80b88abd.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 486455\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vf9493LYBq0gDVJyHDoIf8IBC2TkMXTle2z1PYVS%2FEWW1Kwoir%2FdhEC04dpIwzkXkcVngNIWiDupxVrY06klojDHXSpkKu7Q50U9wCDd9JvguvFTvSqzNKmq84vj\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"611135936dde834c3aaf7a7221c0c4a8\"\r\nLast-Modified: Sat, 06 Dec 2025 06:20:09 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 51768\r\ncf-cache-status: HIT\r\nCF-RAY: 9b042a15b8ff0719-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170391=tUOZ8RdTGViMVT0qRVsHCkEd/bDSrV60ZM36/1fg7dt4ymzJSog+mHM4PBbyfXIj2cVUcwU+RjuOWIEUq07ZLMXkXynq8W+d7yA3jAb0vlIqzxiyuLdsPuMnf0EFrtUwzrvVSH/Y3ArQqqkbbBowjMGG+qwqGfdwYBD3k8xlLq7ltX2p13SyD4ww+LGigZTL\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 6A6D9A8E-CCBF-48BB-97ED-F9D42BE05A95\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":486455,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"611135936dde834c3aaf7a7221c0c4a8","sha1":"bc54ddd95adc718bcccdf0606743046d161d74e9","sha256":"047e2dd38d93d1572c3871f71ae7f34e7506798853bc471d8330436de6c2e353","sha512":"b0bf93ab6e9041970ae87f14a519087735218c795f479c3107b5105d9d7dd9ab13589460fd5657cb79f1bb648e0b3ff1f02c1b9921febf635559f1ba8f426f9c","ssdeep":"12288:J8cUsxN26nlb9TH9sr2oZKpArG0jMh2dUwJRgD:lzxN24HTdcKajMbwvg","tlshash":"19a423e1f6a044efe955ee721e640738b05b65c8c36c7e4056ca943b9f6331e9d0f092","first_seen":"2025-08-29T11:05:53.277372Z","last_seen":"2025-12-29T08:12:31.331218Z","times_seen":285,"resource_available":false,"data":null}},"time_used":3842,"timings":{"blocked":2663,"dns":0,"connect":0,"send":0,"wait":291,"receive":888,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_de72e240-4300-48d6-8f6e-b9cb363e7924.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 117698\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fgEnLCz5LqBnrZB9J9pw1HnEN2Q97El6Iml1DdeaCiOkCJ1O1BQpZYU9HD6wTsqKOrXSxXsONzQY6e8Sxgd0Xq7xKOxfQFjqAeYgkfbZ72ZzRv%2FIpP37y%2FKGdQ%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"875d51b8597a97b96daa5c4c3eaafefd\"\r\nLast-Modified: Wed, 10 Dec 2025 11:51:37 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48476\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a8c4e19a0e9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 5C38DF4D-4820-442B-B533-765D55580B7E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":117698,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"875d51b8597a97b96daa5c4c3eaafefd","sha1":"bdbe15944aacbb25d3795a9882751bab0e25aa41","sha256":"5cd3cd5c2a9dd3c20ddbfbcdff886459c3dd0a3bede9ce34e1daf9059e375ea0","sha512":"718dbdb9f5dd7fe65fbcf893c416cf87efecd27eb6e9f8af92efb0cb0f5ed2831fa5a805b510322c7232db68a958b29d6bb9b3dc9ee1f0f811ef5579a71e0289","ssdeep":"3072:VqUdofN7Rg/0SAT7MpXyPJ1ZpIZlUij14AtAR9e:AUstSAT7vPKlUij+DR9e","tlshash":"7eb312f3e46e905be7bf016c22329c100d7905aa9b7e48d6a9d34b221cddeb2dcf4554","first_seen":"2025-08-29T11:05:53.31739Z","last_seen":"2025-12-27T06:51:48.781217Z","times_seen":291,"resource_available":false,"data":null}},"time_used":6551,"timings":{"blocked":6256,"dns":0,"connect":0,"send":0,"wait":290,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_b219e889-d34b-4c28-b534-674fb2e77fdd.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_b219e889-d34b-4c28-b534-674fb2e77fdd.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 126465\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k3K3OVHxumaN9UAoXHpKy5zp13YvY8c0gFKZPjUXwIJMbAZ0zo72mLAXU1HW9milxwkYzh%2Fa8y7WkpbLE3irKoy5ClRuNHDaC%2FP5%2FrzjgFJ%2FQyqU8fy6odylPq3P\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"cb68d77d0e034b9291159750b41308f6\"\r\nLast-Modified: Wed, 10 Dec 2025 11:55:29 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48472\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047aa5ee860439-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: C14DAD3B-4D7B-42E8-8BC7-9377B8EAA8F5\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":126465,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"cb68d77d0e034b9291159750b41308f6","sha1":"08f7dca37e6e023fcc11e9433a7eb5248147e34d","sha256":"f4c9e4ee232ca817d5307c83ee565d771fe901eb9df6485ac804a0328b4b3b08","sha512":"66296e44d165cf59c01673acb1419aabcf4111f6c07f7a34931c7699ef1ddc9a8dd7dc9091be12c51835000ab63ad7f8e451fb3476e9f684c926d177c973ae09","ssdeep":"3072:a0Y8HCYFUXawQfnvWdkhm6yAMwwAMgDHtc2M//qXAvDH8/Fz2e4:aSt2abWdkhxTwAMJ2M//qXAf","tlshash":"77c31295defabb05c0bb22f51685c2d46c540f4bf6b788310c36b9be78466eea5113c0","first_seen":"2025-12-02T09:48:46.283125Z","last_seen":"2025-12-29T13:58:58.011787Z","times_seen":65,"resource_available":false,"data":null}},"time_used":6649,"timings":{"blocked":6352,"dns":0,"connect":0,"send":0,"wait":293,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.624Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_2cf32c0e-cd2d-4274-8e00-d67d14e5086e.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 74420\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sVlZliir4KPYrX8HC9lvM1knJAvz3mZhZ7NLPl6oKhw%2Fj7wHLBCExhn8imWcFzTDbL%2F9j3jmvk55zccgERj0knOVW01lddaOuB17gLjVAkuhwgld036KUuz00C1J\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"483193845ef29fea49d165317ef2a6a8\"\r\nLast-Modified: Sun, 09 Nov 2025 14:10:35 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48453\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047b196e755dd9-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 48663FB4-74EC-47EA-AC3E-8BD95F0E617C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74420,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"483193845ef29fea49d165317ef2a6a8","sha1":"382aac96ac623bba78227df264daa66115b46e79","sha256":"d6095539bf6cd1bba243fb281b4dd9acf6c4ef964c08f34a9975ecd505499b5f","sha512":"df72aa1d9dc0dd7d6bd87da0d8c72a43ed9dfc444f66db87015a7fb88fc0562ab41a58ca8ba7fd3022c2aa2b52bd61a06b6ec7761978ebf3bd1403bab35565d8","ssdeep":"1536:IyTkZ3JcWGau5IModpGPs+ucKQpFc6+bbyemwMUghiwcoKB0yygRE:EZ3JcWwSpCLFCbyemf1opG","tlshash":"d773f14220534128e78f7076eafabf8ed68270f5f8a527b5cc098ab515c4e1334de769","first_seen":"2025-08-29T11:05:53.093551Z","last_seen":"2025-12-29T08:12:31.398122Z","times_seen":292,"resource_available":false,"data":null}},"time_used":6844,"timings":{"blocked":6550,"dns":0,"connect":0,"send":0,"wait":290,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/sponsor/sponsor_web_2.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.769Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_2.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 41033\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-a049\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nAge: 51796\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 9B3A0006-D8D7-4F83-9889-F40D857B89F1\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41033,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"66036fddf71ff69f45c146ca63883070","sha1":"4b3076a271d5042ef1b6cffc2ff49f421a819f08","sha256":"93c59a52fe04b0050dd4552a135177533afbe2dec54f10c516610b0dee857e0c","sha512":"29c2fc65e144e5d13c011e4897e0bdf771c7b4c249875eca4fa25589625696c71ec015e7e8ef3a5ee45f2a6ae9df3663da0bb736a6fb13c9628f0d0957827c71","ssdeep":"768:6eyNeN9huVfPKv0KhazApErcA6cFKSkS+pbTCx81TxUqIUgYWxDHc9wZGbYGniRl:6eXXh8KcQakywKK++tTCi6xD89HbxiD","tlshash":"b003f15c4c413e7777f19baae00ac84224d11fd4fdd5e3e61a8bc659a843a68bc2540e","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.36254Z","times_seen":2361,"resource_available":false,"data":null}},"time_used":1159,"timings":{"blocked":856,"dns":0,"connect":0,"send":0,"wait":301,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/service.68be110a.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/service.68be110a.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 10641\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-2991\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170389=idzLU/VnowglBgoqJE8E87wM7N2x/XjzHcgPl1shS4I1xcQPPmlzEkFuT2xu+AD7F4ZtTRdDfIH9Us1jlpRGvwS2rGSsoDgxnfRyd3GWrGiywCS9NNen0IIc+8Y2KMwSzT/mRYytP7KLkipz1SkQ2QNVsFqqQ7BWDLeOVIU+W/pttwEmcpHTO5VhtAMg9t42\r\nAge: 51799\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 497B6177-592A-4E78-9C8D-60CB2BBDF62D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10641,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"993784a38ddc1156572bfc3308055ead","sha1":"becff431867226bf323b5a6535fa383992f107eb","sha256":"abca3af980888b08c6cbd57366b3ac94344d66ea048484c4f9867e300ee8703a","sha512":"48790c6340f273a58295fc6607306353ab69d5a818569fe36ef1bffc8fff084b23d37b401e10502b830c67a5efedca56c1c9d778d6198e4069018d055f1869f0","ssdeep":"192:NdsarkpjwOOmfStcnaHtzB3l2eKD9RdfXtRqi3ln+ojjjKMGlnyL5H7nx+:nJQpjgOz9Dd0orKMGlnA5Hbs","tlshash":"8822c0c41e1be1b6d2ffa916b28543a04b3421fda1a24c342d828c04ccad56ac91f9e7","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-10T17:58:48.361392Z","times_seen":2584,"resource_available":false,"data":null}},"time_used":3313,"timings":{"blocked":3021,"dns":0,"connect":0,"send":0,"wait":291,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/b998d6898efa4176baef918651e05c82?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.446Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/b998d6898efa4176baef918651e05c82?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 51307\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4730\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"b998d6898efa4176baef918651e05c82\"; filename*=utf-8''b998d6898efa4176baef918651e05c82\r\ncontent-md5: ub+sQWy43nFXIBuP1XA7+g==\r\ncontent-transfer-encoding: binary\r\netag: \"Fk8VLGygRmBsoLYh3GehvazJmFX-\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:33 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: vKgZ6ncBg\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: lrcAAAA7IxRProIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51307,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"b9bfac416cb8de7157201b8fd5703bfa","sha1":"4f152c6ca046606ca0b621dc67a1bdacc99855fe","sha256":"96cb408455945b8363aaf62db78d811ee2af89dd3257f313a635839ebfe5d568","sha512":"2274f783257bc9aa06d2b90c5092cfbf1cd06414eea1b8bbbe513f990661591f091bacc6183677cf3ff14d73608af1118011177d98e2ea36b854e222c95239a1","ssdeep":"1536:i/BymRw6tNImMVUZ7XGrk/NRcHftYHREkK654q0o7i0M:i/BlRwvWJj0NklQF","tlshash":"db33f1c51e230a1f290130f0db7554a075ff6987ba68baffd5bd81d09c9a8aa17d2c02","first_seen":"2025-10-04T10:52:24.177225Z","last_seen":"2025-12-19T18:58:52.004203Z","times_seen":11,"resource_available":false,"data":null}},"time_used":2134,"timings":{"blocked":1346,"dns":0,"connect":0,"send":0,"wait":520,"receive":268,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/sponsor/sponsor.json?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: D9825077-4F2E-461D-8C85-B789EB0716B7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-08-10T17:58:48.246933Z","times_seen":2852,"resource_available":false,"data":null}},"time_used":463,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":463,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /ecb/8f8306425cb6740e78b2802ff5047afa96a8ae096bee393c421cac4924db741c4a080b3f3ed2f2822673f3118bd3bae081df46a59bfce8 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://f214n.xyz\r\nXign: WRY1JIa+TQVCBR0Q/jxy8VSm2yfEWHguNJpMfClNf3azoz40KplFCDi7xx/dmwz+xL7nhSGJHbaEyOe9/hCekTjrKGeNABPjgTN7W5KBLUKUSSlefvoROWnF0lp7hRr3TQoTm86MXM7OJB/9ZHcVsVxhXoDGmUv/meM9p09fuiY=\r\ntimestamp: 1766170386705\r\nsign: 5o3f5e1k5q784v70\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Fri, 19 Dec 2025 18:56:07 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 321D67F1-43EC-4731-95DA-0A8D5B0D8CC7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"aa1fe36cc499baa3fbdc7ab9bda7432f","sha1":"201b0fc1c4c699f3538c8e3992ec08ecd2f3acb3","sha256":"d509d9e26b3c3a371856286d14bcdd4f17125a10d8ee40e119fdecaf964fb478","sha512":"2dff3b34740cc9d3690f596673675516493472f5ad4bbd3536b5b1b18922543771be73e01051874bc7039aef9461cedb841f0cbe4945118bdea5773a4b3f7a55","ssdeep":"","tlshash":"03b012a2d5a309ed9644713104305c414be022ccc9bcf858c7bc4d2b45650210494105","first_seen":"2025-08-09T20:01:46.169117Z","last_seen":"2026-08-02T09:02:15.066072Z","times_seen":1564,"resource_available":false,"data":null}},"time_used":955,"timings":{"blocked":515,"dns":0,"connect":0,"send":0,"wait":440,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x422_936e6f39-c72d-42ec-ab51-2bd5a806c902.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 88572\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EV40arRiQk9iRkB%2BWuQNU3zfPxop4RhRUuD03xSMRWILtBEyxOemtBknYgeqO5EALFJNqG2m5fVVgHPMzF%2BcDP96qJlJUHLC28NuHg4xdY2uiHJE9d%2Bizlqw47%2F9\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"06a585f41fc826b5347e04ee59ff56b7\"\r\nLast-Modified: Tue, 02 Dec 2025 14:11:45 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48473\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047aa0affb9b84-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 0DA138DE-C040-4304-8992-9908AA1578B5\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":88572,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 422, 8-bit/color RGBA, non-interlaced","md5":"06a585f41fc826b5347e04ee59ff56b7","sha1":"1357eea1219b34aeda8b3ff0643b01f75264656b","sha256":"0fee4da04a467bded4cef5fd0200fe14d5f81cd79a42d95e2cfcf48591335822","sha512":"b06f99d758a92961e244aa05e7857e352935deef71d7478a6e7732f663822cc33b68139a539355c400bc641bcf3a8f48c147903416d1f941999f1c02f76e69c5","ssdeep":"1536:i8UehXCmLCRQjvGvRyM06zzwtzB3tDxwjdPsvEPDWX0I+WHr3:iOB0Ryudk3tDonDx7mr3","tlshash":"598302ec999d325ef0cb9232409a310a7435e01b1fe4d721a5c5aea581dbca5ff2ce09","first_seen":"2025-08-29T11:05:53.264183Z","last_seen":"2025-12-29T13:58:58.052124Z","times_seen":299,"resource_available":false,"data":null}},"time_used":7156,"timings":{"blocked":6834,"dns":0,"connect":0,"send":0,"wait":318,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/index-399e2569.1756903329400.c784c4ca.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/index-399e2569.1756903329400.c784c4ca.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-5b7d\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170384=UXdgwTadCNGnycLW4Zj5I9uCe+sKxgsmiX8KxJnX/l7K6YcQVeX1HiLd/rCstBD5HLpnkenZga6azTJP1cU5nZmlxt9PR0QGMiNerYL7dN5sz61ocfilE3++ukyV1lhJw+0u6na49gu9BS7923+W6EtpFMQuPzUrtxOS2JSxMij9cMe193orUuIYY0/89ij1\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 8D687A67-BEFE-4589-868A-4B76970E7090\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23421,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23421), with no line terminators","md5":"6117cdb5accd41ccb0125c70452306f1","sha1":"80f85cd8a495c476087fa382198b2a06f5d309ae","sha256":"794e522144c7d6885ba07f4654bbf62f0b06f1b985a897645092cdf029afcfea","sha512":"1737016527bd862c7804e4dd164e109c7f3a087b5c0a751764c22f8b2fa9a10f4fddb8f98234d4da33eaf7a314648d28eed89c0750dabf2006ee105b6f8a2cc8","ssdeep":"384:EZSANHLDaxKalO7PT/Wy4QfHhwrxrjgIhK47ZyQQvXTcdw5F3oWf0Af/nqxtU8X:HYDaxKUO7LZ4QvhwVEMKUZpe5FYxAfPQ","tlshash":"c6b2c6e63392bda4c24f9276f33a58ecc53f9241c30fc4f8d265bdd47da8644a992684","first_seen":"2025-09-04T00:49:32.717031Z","last_seen":"2025-12-29T13:58:58.089613Z","times_seen":434,"resource_available":true,"data":null}},"time_used":2523,"timings":{"blocked":2068,"dns":0,"connect":0,"send":0,"wait":454,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/38572956d3b84010a9fca6dd2b6ff7fa?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.556Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/38572956d3b84010a9fca6dd2b6ff7fa?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 23657\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 37074\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"38572956d3b84010a9fca6dd2b6ff7fa\"; filename*=utf-8''38572956d3b84010a9fca6dd2b6ff7fa\r\ncontent-md5: XoWqiI0zfbvtcuFBVlda9g==\r\ncontent-transfer-encoding: binary\r\netag: \"FryYtpg1BzxXoNSNfcomHeTWLzsL\"\r\nlast-modified: Sat, 13 Dec 2025 19:06:33 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: tdMp9163l\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: BEQAAABwRKXkkIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23657,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"5e85aa888d337dbbed72e14156575af6","sha1":"bc98b69835073c57a0d48d7dca261de4d62f3b0b","sha256":"ed8d8f0cf4cd7511ad8c8292a1e33948a655c487a85d8417a743754ad42850ca","sha512":"aaae75965c20fd71463683a526ed18ddcd154da90ad08b8b81054de6566622e1bc2d7449eee1de96eea33b6c8f9cd6240822a42204809e587ed4a679e4b58deb","ssdeep":"384:qaiBT097/SE2Da/ZaU3iN+ZDD4eV+pr5RziPhRogJmXgTM8B+G/MaLyZL6ekzEgl:4BTGOE2Da/Z5SU+RbzUogJmXXSNvLQRO","tlshash":"26b2e050f06a54f3484373f5a0cb2ae35d2f6317046afaf5be76867a398e4626e13805","first_seen":"2023-10-21T16:28:24Z","last_seen":"2026-05-02T04:22:49.201844Z","times_seen":280,"resource_available":false,"data":null}},"time_used":2900,"timings":{"blocked":1239,"dns":0,"connect":0,"send":0,"wait":1287,"receive":374,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/3b8e18f779fe4ea3828487b1c0868e1e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.538Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/3b8e18f779fe4ea3828487b1c0868e1e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 12694\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 84179\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"3b8e18f779fe4ea3828487b1c0868e1e\"; filename*=utf-8''3b8e18f779fe4ea3828487b1c0868e1e\r\ncontent-md5: ic2t9s8etvjSUH3h4B+AbA==\r\ncontent-transfer-encoding: binary\r\netag: \"FoiVLdsKFIBRzJynxrP3OEw35mX7\"\r\nlast-modified: Sat, 13 Dec 2025 19:03:17 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: SJcRhWgHC\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: _PYAAABlyysNZoIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12694,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit gray+alpha, non-interlaced","md5":"89cdadf6cf1eb6f8d2507de1e01f806c","sha1":"88952ddb0a148051cc9ca7c6b3f7384c37e665fb","sha256":"a0a38e80c565b279fd31b468630cfdda41767279778e0bc7261efcfd71d6613b","sha512":"a3167dde189e55660e8bc15e12eddd3cf377a6a46a6b3ec4181899cb1fe80f7dc00b3ae300c07a1eed1e1d95286413e4f1279ca0ec21d2105c0baabdd2670df5","ssdeep":"192:9C8edOc284OI5IhUMlcSy3tlTURxQTyRcEPNL8U3mTdOqorE7h7NAQxdrP9DKA8d:dchTIOhNfkY6AcaNQU3AOP8LcyQ4Q","tlshash":"fa42c010823c95c9e01e258d339bc5a1782982df728b2517d51e6a86220a46def3bf1d","first_seen":"2024-08-19T15:01:26.166922Z","last_seen":"2026-05-15T23:42:44.55913Z","times_seen":286,"resource_available":false,"data":null}},"time_used":2711,"timings":{"blocked":1257,"dns":0,"connect":0,"send":0,"wait":1288,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/1ac53b9d3f4749d09c3f8a31f6209b2e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/1ac53b9d3f4749d09c3f8a31f6209b2e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 85245\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 22962\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1ac53b9d3f4749d09c3f8a31f6209b2e\"; filename*=utf-8''1ac53b9d3f4749d09c3f8a31f6209b2e\r\ncontent-md5: s2WtDoXisby/Y/eg8vcKeQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FlqMtbTRYFVRe-qsbpalFULgRytm\"\r\nlast-modified: Sat, 13 Dec 2025 19:07:38 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: TJyv4RTYy\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 6-EAAACaj0a6nYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85245,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"b365ad0e85e2b1bcbf63f7a0f2f70a79","sha1":"5a8cb5b4d16055517beaac6e96a51542e0472b66","sha256":"6d6b875c28d823fc72e52b4d4cd8f7c832adbce9ceecdbf4c9be41f00349826d","sha512":"1f03424999953553474d1da7326a39f9ada85437a41aeb6c3be03432906bb7598866b84181ca471165972cce2f1a6b81e0ea6f735ddf9e00438982e3b1fb5050","ssdeep":"1536:8o9jZLSJvy26uNIy8SWsNgRwJvIrTiIKu03nfrGBLLSW:dj5KV6unFWuvIyu0vrGZLSW","tlshash":"548302a34403759f8becbe9a169bbc20b6731bd2d32527a853055c7e20dd045c6767c7","first_seen":"2024-12-26T20:26:09.887304Z","last_seen":"2026-08-09T13:56:35.979558Z","times_seen":472,"resource_available":false,"data":null}},"time_used":3226,"timings":{"blocked":1222,"dns":0,"connect":0,"send":0,"wait":1288,"receive":716,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/index-a3dad144.1756903329400.268893b8.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/index-a3dad144.1756903329400.268893b8.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-551ed\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170384=UXdgwTadCNGnycLW4Zj5I9uCe+sKxgsmiX8KxJnX/l7K6YcQVeX1HiLd/rCstBD5HLpnkenZga6azTJP1cU5nZmlxt9PR0QGMiNerYL7dN5sz61ocfilE3++ukyV1lhJw+0u6na49gu9BS7923+W6EtpFMQuPzUrtxOS2JSxMij9cMe193orUuIYY0/89ij1\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 59EB0F5C-4762-4098-92B5-92DCBF571213\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":348653,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64496), with no line terminators","md5":"e70d98f5d06556fb2df3ec9ecd519e37","sha1":"f15f33973e2498e949a62791b8fa6c7ff03c7a98","sha256":"7c6448354a71dab7081c1a9083e1ef15f7c59ff568fb924930620b4758169df2","sha512":"d225d0cca1709f789e457dd14df16ceda4bf4118d6c8f9db25bb9cbd5f30151e6b23d497ba51761a0eba97686323b0393dcfe43652e832dbaecc97b69bccf802","ssdeep":"6144:G4InKyBbhFOuyKO0VPoJBR58n3inyHpZolRlY1z9f7ZwTl0A+:izc90VPoJBR58n3inyHpH1z9ftM+","tlshash":"d7743b94f76cf1bd874e55be793290a4902c1b41b0c89d58d29e2944ff6b385eeb08bc","first_seen":"2025-09-04T00:49:32.964012Z","last_seen":"2025-12-29T13:58:57.98751Z","times_seen":435,"resource_available":true,"data":null}},"time_used":2813,"timings":{"blocked":2031,"dns":0,"connect":0,"send":0,"wait":475,"receive":307,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1884x434_f0f83841-a720-4f18-8acd-c726f4c1e685.jpg","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1884x434_f0f83841-a720-4f18-8acd-c726f4c1e685.jpg HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UXPWuQANIJMc48op7U1NS9a5CWgZe4E5BEzXjPw%2F%2BHbUZl8mSF0V4U1j4JUC5GDfZrn9Q8q6P4upHu%2Bja5XthourLXxApSPE8CH%2F0m%2FF90oXNyuwjzZC8Sk0VeCn\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"9a51e62132d61aed9329d3365be2ebe0\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:26 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 44465\r\ncf-cache-status: HIT\r\nCF-RAY: 9b0919ee6dea74bd-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 324F9B24-8E82-41D7-B565-A934E73177EE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":363024,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"9a51e62132d61aed9329d3365be2ebe0","sha1":"ba931e82f0a0d6918ce044f0f615558efe8be66c","sha256":"71597c4dfe22a7312b692b0cd0a2f44582566617510a23883a44e84045882362","sha512":"9d94dc049160f5dae8daa5ac6038b90087c0093987feac83bee54a97063ee0b46a60f8ee5172d1726662db7c938489fb08f99a98df4020ab2756be9f83751339","ssdeep":"6144:QQgiqnqSjhCWWT0HqPrWJehmhH6rFITZWJEkA0DmfsskR7s+kQXpNhd3:QYiqSFMT/jWJehyaJLEFssE7O+3","tlshash":"e37423928e8f8c8257bf9f7114027c4e9048dbc6b9d107e05238de998efe508d6ac68d","first_seen":"2025-08-29T11:05:53.128791Z","last_seen":"2025-12-29T13:58:58.049671Z","times_seen":343,"resource_available":false,"data":null}},"time_used":3158,"timings":{"blocked":2420,"dns":0,"connect":0,"send":0,"wait":475,"receive":263,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1884x434_8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.083Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1884x434_8953c3b5-a3a1-4b97-a677-4b5efb3fb94a.jpg HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:11 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dXToqrX7G1DhnvhpCs2pnSOgXwUJjMMh9pUvKIPPjabCVZvJbRjlSceo1PxyxZSCJIeZB4h8dgZzQodhM%2B8V%2BsicARw9dO2L4ZABUfsrks1sPUtu7Fb4LuenwhwI\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"4ba8eca994e0876f66da342a8f47763e\"\r\nLast-Modified: Wed, 10 Dec 2025 10:48:19 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 60996\r\ncf-cache-status: HIT\r\nCF-RAY: 9b0919f02eeb0965-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170391=tUOZ8RdTGViMVT0qRVsHCkEd/bDSrV60ZM36/1fg7dt4ymzJSog+mHM4PBbyfXIj2cVUcwU+RjuOWIEUq07ZLMXkXynq8W+d7yA3jAb0vlIqzxiyuLdsPuMnf0EFrtUwzrvVSH/Y3ArQqqkbbBowjMGG+qwqGfdwYBD3k8xlLq7ltX2p13SyD4ww+LGigZTL\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 1B191187-CA2E-4F36-9F32-EBD43F70D658\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":359196,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 1884x434, components 3","md5":"4ba8eca994e0876f66da342a8f47763e","sha1":"5f483535de56c4253674b0a35d3877d0dd200a82","sha256":"0f95823dd45056d46accd12818e592b49ac3f5050accf68610b4371c62320ede","sha512":"6b69475dcf180cb83d799e6fce9c07ecd91df196e3821adbcd7f4eb90c3831799ba864e2c35760f72d2dc5e5e7e3b74726a83efab3f5a1c3234d965e46def7c7","ssdeep":"6144:dqJy3fkqKTt3/vdG/ZHOMjOUZgO1EjSa+6V4IG1ukzX+wPpoSLB/ON:2wstNGJZjhu6EL+sGIqJs","tlshash":"4f7412e67e777d4b86b68fb6f3d02e4811919b02dce115487854f42328eb0ece89ec59","first_seen":"2025-08-29T11:05:53.189307Z","last_seen":"2025-12-29T12:28:25.234625Z","times_seen":340,"resource_available":false,"data":null}},"time_used":4252,"timings":{"blocked":2674,"dns":0,"connect":0,"send":0,"wait":508,"receive":1070,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/zeren.c0aa584f.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.013Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/zeren.c0aa584f.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 3322\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-cfa\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nAge: 51798\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 36E680F0-C6C5-4A5A-A854-A9C7D7994CB7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 414 x 130, 4-bit colormap, non-interlaced","md5":"217588cbcd6216a09cac17953ae710b1","sha1":"de250755d284bb75dcee38ee45f2fc839987dcba","sha256":"24c2821b322d0c9087bcb0727dc0307311f6cfbb52af9f8a93308e48705f706e","sha512":"da190054ec0862c9927bb3bd928481459d53d4d778e9b2928c2507f2a34df5791d43adda750fcf184b767c1ba3a3f92e45dc57242a80869e253a9b37639abb4a","ssdeep":"","tlshash":"50616c01eb9130b8129c286701bd3fcda4c64d993d203d798d87b29bd6f970d288b123","first_seen":"2025-08-29T11:05:53.326961Z","last_seen":"2026-08-10T17:58:48.470892Z","times_seen":2434,"resource_available":false,"data":null}},"time_used":4743,"timings":{"blocked":4445,"dns":0,"connect":0,"send":0,"wait":297,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/04454b729b1b445baab3ac717624e6d3?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.470Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/04454b729b1b445baab3ac717624e6d3?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 5784\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2987\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"04454b729b1b445baab3ac717624e6d3\"; filename*=utf-8''04454b729b1b445baab3ac717624e6d3\r\ncontent-md5: yRH+YsuO2MpkVHZ6RYwluw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fr1arnHhcj_vmYICQ7wJ_ejVxBvT\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:36 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: e21tcPFRI\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: mEYAAADGf-Hkr4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5784,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 120 x 160, 8-bit colormap, non-interlaced","md5":"c911fe62cb8ed8ca6454767a458c25bb","sha1":"bd5aae71e1723fef99820243bc09fde8d5c41bd3","sha256":"b174d2aa20f8104aab734f3a7cba8cb7eb2b8a243a284f7643c0f0ad3fc6261d","sha512":"268a6256323f9829748f56055be6417ac3805e9996e0c01590c304d22012a7d96228182e987a585dbdee35da8aef7bac02b7e27a91a01a0a86ea5dc8e8aa9111","ssdeep":"96:pCz8pryD8WeJV91GGA1TrwhjrMCRkiHTEQl44yQrTWd57NEPKVEWsibbJMIksU6+:pCg9yD85JUGOskCR5HTEQlkAid5NHV5M","tlshash":"26c1affea0b943bed06a7a1767019e620723c531c72acdd7aeca641d17058779e4382f","first_seen":"2025-12-19T18:54:13.803259Z","last_seen":"2026-02-28T19:04:25.842081Z","times_seen":10,"resource_available":false,"data":null}},"time_used":2460,"timings":{"blocked":1323,"dns":0,"connect":0,"send":0,"wait":1087,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/ESPORT.4f4b51d4.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.811Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/ESPORT.4f4b51d4.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 65968\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-101b0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nAge: 51781\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 00CCE736-AEA5-422C-A60A-8DC6EDD919A5\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":65968,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"29610094acb703084f79c42c17547a7c","sha1":"3c824ba387e36bcce1a5f1d0d14b513fb278db9d","sha256":"8c3dc9ee49224eff4a37ec488ff0a413f3150ec7a62640a466a802750a573146","sha512":"db986acc62bb0d35583a1c298b468e1fa7869269c738eadc82b944b1a8f9b2c0723087db8a065d60495938e834337e72e3c438089d1d02ff90f4983e0d6461fb","ssdeep":"1536:ObUUUNbT8bJcHe4DyC8KLT/KKeRfm4AH7XAlzS7M2Z:rbgNcHwE/eshbE/2Z","tlshash":"b25302e1df60cb022efe65ca89acf12ae204a0a61476453f7a231d6f3744016af973c4","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.445069Z","times_seen":2364,"resource_available":false,"data":null}},"time_used":1200,"timings":{"blocked":596,"dns":0,"connect":0,"send":0,"wait":302,"receive":302,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/sponsor/sponsor_nav_web_2.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_2.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 6434\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1922\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nAge: 51799\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 17DA6428-FC2F-4BB2-B9A5-5B0324619CCA\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6434,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"e31cb9f70abcc458288bb53868031352","sha1":"965f7cb9aaf0d166c21b8681b0671d17e019c74e","sha256":"33295ad776e1fde54dace5b0343c9aab9a2d70cfa8848e5cbd09065c340e294f","sha512":"acd328b1f4cb6e1c7267696487f637ea5ae4b724f7ab32516632a3eb2c8b4e374fa472ab77120230258fb49a23f54ba3988b155004b46e69519fe3ef57ee79c9","ssdeep":"192:RYc0QiGWn0WG2WmjNJMjOluoj/xrASMJmoJESULHT:RYc0QiGlHmjOo1j/xPMAG2Lz","tlshash":"c9d18ea6ea2a4a52cf8d0d633efc5b0671508e582f390826809a1d1d57767fa24a13e7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.260713Z","times_seen":2230,"resource_available":false,"data":null}},"time_used":4390,"timings":{"blocked":4100,"dns":0,"connect":0,"send":0,"wait":289,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/064d500afcda49f8aa6f6708e86bb38a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.563Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/064d500afcda49f8aa6f6708e86bb38a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 30458\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 29268\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"064d500afcda49f8aa6f6708e86bb38a\"; filename*=utf-8''064d500afcda49f8aa6f6708e86bb38a\r\ncontent-md5: 8eldi5XYWJve39zt0xj0Ag==\r\ncontent-transfer-encoding: binary\r\netag: \"FvPz9GlzSiilO42bj5L5_Wv3sHgP\"\r\nlast-modified: Sat, 13 Dec 2025 19:06:51 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: qSO9YG6gl\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 5tMAAADppSH-l4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":30458,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"f1e95d8b95d8589bdedfdcedd318f402","sha1":"f3f3f469734a28a53b8d9b8f92f9fd6bf7b0780f","sha256":"faa41deeb07bb875805cf995b3b5c6bae2bccc0561c927d8a8db9de8d288e3d3","sha512":"ee28f8f6350351b6a9699a52809fc404db23612398d31cd3e8585e23872a6fb18a07a2f45453fe90f7cb74b4bba76ab7a81ab3b92f67e41de18e88ca12e6c758","ssdeep":"768:XPQCXC7gxHcZScfBfQY7gzxHXyYyM9c7yyKzGRQvbTfz:XYPc9D0Brg97Jc7tKzGSvbv","tlshash":"72d2f212bd38603f9732172fa8fc6550a2fe04b0f161fc179d2b656d72130252463de6","first_seen":"2023-10-28T07:36:03Z","last_seen":"2026-08-01T08:19:45.812662Z","times_seen":143,"resource_available":false,"data":null}},"time_used":2931,"timings":{"blocked":1232,"dns":0,"connect":0,"send":0,"wait":1288,"receive":411,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/34470e0add0f44fb88c32348ead84e94?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/34470e0add0f44fb88c32348ead84e94?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 54142\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13982\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"34470e0add0f44fb88c32348ead84e94\"; filename*=utf-8''34470e0add0f44fb88c32348ead84e94\r\ncontent-md5: CWi7ioZE+0S1gcSetpb9LQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FnQYmDIF5GNICdqo4E8jzlTRV9nu\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:42 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: thxauTwtW\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: TiIAAAB56g7lpYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54142,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"0968bb8a8644fb44b581c49eb696fd2d","sha1":"7418983205e4634809daa8e04f23ce54d157d9ee","sha256":"87dac5ec07340804d58dfe54c5a20e20835bc1c5dd066a34215422db25637830","sha512":"baeec27cd7d7e3f91b477fc26d873af98bc556d067b5137cd599cc87f965abd66095ddbb475b3dd3144ce28031c71bd07c9ee285e3b553d283aea71440b8f095","ssdeep":"768:iSDik3Jwb5VEi07aI2bujTteEfk0zq3QqEGFGAeaynrIY44Z/ZEr0jLtggEnHWzE:iSDiR67aI0ujoT3QqXGA2rDTjZgdn2zE","tlshash":"d33301ec8fd6338627e464bbd344d25a898ddb16c99f08a4ff467afd6865911328002f","first_seen":"2025-02-04T17:13:00.980594Z","last_seen":"2026-08-08T12:57:06.98618Z","times_seen":197,"resource_available":false,"data":null}},"time_used":3270,"timings":{"blocked":1192,"dns":0,"connect":0,"send":0,"wait":1293,"receive":785,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/3cd34cfebf334adf9021ae0983481c9d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/3cd34cfebf334adf9021ae0983481c9d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 83553\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13981\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"3cd34cfebf334adf9021ae0983481c9d\"; filename*=utf-8''3cd34cfebf334adf9021ae0983481c9d\r\ncontent-md5: m0OmkNWgnx4xnwNoIejh0w==\r\ncontent-transfer-encoding: binary\r\netag: \"FowYnSMK5U7gsc9HHzuU5q5kIu8Y\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:43 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: r27flNK7B\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: EhUAAAAK9U7lpYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":83553,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"9b43a690d5a09f1e319f036821e8e1d3","sha1":"8c189d230ae54ee0b1cf471f3b94e6ae6422ef18","sha256":"134c96509adde7a2c9afadb08cbf80912dfa6bb23ce380b8477a0f8d3082c4ed","sha512":"d3f91c9b93f6bc4a44a129aaf50389c8d1d1d3a370aef596e5502f7eaa410f0e591c5d80d14440c348c466f2b595a8eb8ec11555907e026b865195d3a3ca813f","ssdeep":"1536:MV7U/tbKlY7wNcTSngrT+wSpPOLKG92MMdjHjuMxZayIK8R5yzC8O0CTW:MV4/0lVNkrTPSpPnZVnx/e538ZCy","tlshash":"908312ba6c734dd782f9fede13b6f09ba9c8b575b7b0de5e74513c18aaa04a20430111","first_seen":"2024-12-26T20:26:09.90712Z","last_seen":"2026-06-05T22:09:33.514208Z","times_seen":241,"resource_available":false,"data":null}},"time_used":3314,"timings":{"blocked":1185,"dns":0,"connect":0,"send":0,"wait":1285,"receive":844,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/license.ea57c78d.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.005Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/license.ea57c78d.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 1976\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7b8\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nAge: 51798\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: FB3440D6-1B6C-401B-91CA-A1EBB7D37CC6\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1976,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 161 x 52, 4-bit colormap, non-interlaced","md5":"60a2c7c150b01809fbb7b97932684b5b","sha1":"67fc9647c452a17b519c6a51dc8c38daa23755f9","sha256":"c5ce31558a1f979ae78c7779d2f312b196750375541e9c147b73d6e44d47c276","sha512":"2328442fa1c74e47c6eff4adab55920c7e7738e7ae51bd2b222fb696bbcf8201a14805089a33baa80c28a40db47061048d817c384bd72735b2e0c0116ff63c6f","ssdeep":"","tlshash":"b3412a6266729beced1a8c47592c7df1d8338ca1a200e1c150ed761f1bf8e1060e7a94","first_seen":"2025-08-29T11:05:53.23289Z","last_seen":"2026-08-10T17:58:48.288942Z","times_seen":2497,"resource_available":false,"data":null}},"time_used":4547,"timings":{"blocked":4248,"dns":0,"connect":0,"send":0,"wait":299,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/bf52f80e1160475ba535d650d228bd5e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/bf52f80e1160475ba535d650d228bd5e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 11114\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15785\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"bf52f80e1160475ba535d650d228bd5e\"; filename*=utf-8''bf52f80e1160475ba535d650d228bd5e\r\ncontent-md5: Ah56aT7UBzHSMnBYNOucDw==\r\ncontent-transfer-encoding: binary\r\netag: \"FsM1BcDMOOe69YYvJjW5zIjo0BN0\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:19 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: B8qPwGyVO\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: JLsAAACtIlJBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11114,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"021e7a693ed40731d232705834eb9c0f","sha1":"c33505c0cc38e7baf5862f2635b9cc88e8d01374","sha256":"c58f6a03e2c022633b3b1c1fddc57f11a9a17d2bd9dba1d396c589af1c796924","sha512":"168510e80b099cb87aa09c98e89b07659a1e7e9fc3184a325a55a307b7c3f8800208ea0dfb120ab13f3a045012f570640fe1517e97c8091f6ef2905ae1c41edb","ssdeep":"192:A+GJLvp/6isz6k0tIKfWzhbxTn8TFY++lCxf4rEISBrIT1zoa9RIurRh:qJLvd6t2tIKfW1FT8TFXrxzIS41kaR","tlshash":"7b32cfe45747939bdf0294fba4053d043c0c2b615856eda14cb1dee61a594fca6a8ab0","first_seen":"2023-12-02T20:28:22Z","last_seen":"2026-05-15T23:42:44.597863Z","times_seen":193,"resource_available":false,"data":null}},"time_used":2955,"timings":{"blocked":1197,"dns":0,"connect":0,"send":0,"wait":1296,"receive":462,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.609Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_b0506ddf-52e0-4b2d-8f59-16f795505312.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 473762\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=TLmx8Phkrypm2TT0QSrGsgC96LKO%2FFuNb%2BUb%2FE%2BYZO%2F6zCC0okWUFmlUdtjOwS7i6uMDYg%2BCKcMn%2Fcr6Nh6DfwaR8rVM88A%2BpxAUXwWkkRDjeVSZ953E8Jt%2BOY3Z\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"cc5f88340212cac674500954aead1456\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:17 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48451\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047b1c2cc05de7-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 375B9899-A9B9-4A50-973F-BB3425E8A07F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":473762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"cc5f88340212cac674500954aead1456","sha1":"f90402519324070fe5387747aa568406615353b9","sha256":"eddd66a7205f52d67435b916c2fffea6024a6ecffdf74627cec55c7e4aa9f1fc","sha512":"fd5276c4c317e70b7c660edc9b4f71fb45c690d159a5ecaef28f9f9bb077225eda071915b2a5a6bdd28a525517e6ef38881b1d76201fecfe84f2093dce47a7dc","ssdeep":"12288:eY/dfPbc6XDpHO8KH4+h1+CNA93hMXHov7REUn+cBw5n+HtH:93b1SHQZhM3NABBw5GH","tlshash":"75a433612695f7273775ebf0cd7311ea3181e500a3ea64a7df6bc11a41e68a0b4ec31a","first_seen":"2025-08-29T11:05:53.308158Z","last_seen":"2025-12-29T08:12:31.3923Z","times_seen":284,"resource_available":false,"data":null}},"time_used":7055,"timings":{"blocked":4653,"dns":0,"connect":0,"send":0,"wait":300,"receive":2102,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/css/52388.1756903329400.023ec95e.css","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /css/52388.1756903329400.023ec95e.css HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83893-10ce\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 51BF41F9-1694-43C2-9844-E999F45EFD42\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4302,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4302), with no line terminators","md5":"4efa3b550af4fa3ebee130f514631a7c","sha1":"52f29a161a644ebd6eb64fdc07b98e62115eec6e","sha256":"9b87a918545ad75490c79272f4c435c319793820eef518ca60893ba92fbbc8cf","sha512":"096e5f166461728d63ce720dec1310e40390420bfd76d5d13406ad6f2720a55ef6131fcc40f021c6029eec962a1315614a0c7cae55717e6d3466bbabd48dfa43","ssdeep":"96:k8WL6Lfl5F3fPFqNu9h0ShU1ulYUsH270RHeO5k0IWlLBUWl1dLIrEjWm//:k0Lfl5F3fPFqNu96ShU1ullsH270RHe4","tlshash":"2c91124bf89ca23f58bab7ac59c7a55da45644059b270aade31c35e0438b4e0c133eec","first_seen":"2025-08-05T06:40:24.237782Z","last_seen":"2026-04-26T06:01:09.995598Z","times_seen":1255,"resource_available":false,"data":null}},"time_used":462,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":462,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/loading.da46bff6.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.050Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/loading.da46bff6.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 473164\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-7384c\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170389=idzLU/VnowglBgoqJE8E87wM7N2x/XjzHcgPl1shS4I1xcQPPmlzEkFuT2xu+AD7F4ZtTRdDfIH9Us1jlpRGvwS2rGSsoDgxnfRyd3GWrGiywCS9NNen0IIc+8Y2KMwSzT/mRYytP7KLkipz1SkQ2QNVsFqqQ7BWDLeOVIU+W/pttwEmcpHTO5VhtAMg9t42\r\nAge: 51796\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 725E9E6B-15F5-4693-BC4D-7451EFC10974\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":473164,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"ac7ca483f10bc73cffa89f639f6ffa56","sha1":"03873b9607c635752526968af31773498d259afa","sha256":"a054b81d2850fe2da5b4f97a1c50c05ee59a24c37f1c700e5cc45fe6079598b6","sha512":"caa6b3e243f02c86ccaf71aafd0e716834a7a0cf07305c5c7cc0a1b9d637cc2802caa067b0010c7c3c064e3fe8f7881b26992f57137f98477266653342257760","ssdeep":"6144:NFoYczeWIF3Q/IUPYhuF0KX38I4z/tcKZPehCIjAl/CS+b:rLczeTUPpF083CBdeh7MlvI","tlshash":"79a423929b411988e1096432215fab4d23993b6458ab5fbf78843d88893cf059ff763f","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-10T17:58:48.426547Z","times_seen":2243,"resource_available":false,"data":null}},"time_used":3982,"timings":{"blocked":3368,"dns":0,"connect":0,"send":0,"wait":297,"receive":317,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/76b72a2633af4c429513674e48bfef0d?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/76b72a2633af4c429513674e48bfef0d?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 21756\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3168\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"76b72a2633af4c429513674e48bfef0d\"; filename*=utf-8''76b72a2633af4c429513674e48bfef0d\r\ncontent-md5: yxNMWsR+RtYW0bVzt1fprg==\r\ncontent-transfer-encoding: binary\r\netag: \"FglYaITzo8EEx7yKdoOSM_mn5HGQ\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: 1iwK4I0DT\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: ANEAAABCbPa6r4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":21756,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 149 x 149, 8-bit/color RGBA, non-interlaced","md5":"cb134c5ac47e46d616d1b573b757e9ae","sha1":"09586884f3a3c104c7bc8a76839233f9a7e47190","sha256":"45769fc965270edc6d0d1616ea94fa6815fe39a9c863a83fa8cec077784133d4","sha512":"344cd6bc3d5350a9e310e2138aadb034a8e0f420397e0b9961e3db4ebc1ae6d585aecfd515e89e1a6dd73087f9f9c7a0353e20c3c2df1cb9eedb7bff8a56aba4","ssdeep":"384:fBLw+lg3YZgDh9zq7UzK29zKJ7fww+8VQMkKXHKrx:fBLwwwhJqIz7dKZYDSkKXKt","tlshash":"22a2d09c74f051eb152fe91229cee6dab3f3b197140b8abeca5775208bfd008063a5d5","first_seen":"2024-08-19T14:24:45.256534Z","last_seen":"2026-05-01T14:24:54.824101Z","times_seen":75,"resource_available":false,"data":null}},"time_used":2622,"timings":{"blocked":1300,"dns":0,"connect":0,"send":0,"wait":1252,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"img.esportsdata.cc/202/1/1f9142fe4216cd4b9115e8ff1cdff61b.png?win007=sell","fqdn":"img.esportsdata.cc","domain":"esportsdata.cc","tld":"cc"},"ip":{"addr":"104.26.2.221","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.620Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"esportsdata.cc","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 19 Nov 2025 17:04:23 GMT","end":"Tue, 17 Feb 2026 18:04:20 GMT"},"fingerprint":{"sha1":"A6:E0:51:55:F3:DD:1C:A3:91:3B:6B:52:24:2C:20:18:2C:4F:CE:25","sha256":"53:84:30:04:E7:7E:B1:BB:5C:2E:FE:6C:8F:08:8D:BF:9D:85:E2:A2:5E:E8:25:B9:21:25:A2:5A:15:88:C1:46"}}},"request":{"raw":"GET /202/1/1f9142fe4216cd4b9115e8ff1cdff61b.png?win007=sell HTTP/1.1\r\nHost: img.esportsdata.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Fri, 19 Dec 2025 18:53:07 GMT\r\ncontent-type: image/png\r\ncontent-length: 116979\r\nserver: cloudflare\r\naccept-ranges: bytes\r\netag: \"7d35c67da2b80a3092e25e784ce21762\"\r\nlast-modified: Fri, 07 Nov 2025 04:20:17 GMT\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\nvary: Origin, accept-encoding\r\nx-amz-id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8\r\nx-amz-request-id: 1882B1AB0CEA71B8\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nage: 1035\r\ncache-control: max-age=2678400\r\ncf-cache-status: HIT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qcdoKnT67Q49gy3v10k%2FSC5p2bIVQlXtAcE%2Fki%2Bqcs%2Fnj44%2BXiM2Q2Ws6E%2FInNycSJRNshkNFjhuUypf%2BgNdC70v5oJIssegslKBOctEBSvc\"}]}\r\ncf-ray: 9b0919db08a82efa-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":116979,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 360, 8-bit/color RGBA, non-interlaced","md5":"7d35c67da2b80a3092e25e784ce21762","sha1":"5f3cb5ec88511617b043cca1428d9638c1af93ac","sha256":"29d933c9c0719ef61bbad7c4ccd9a3141c5527d7fcbb66d13f7d2d210d258c36","sha512":"44367b171dea606aa6ff4dcc18adcd4cb1917636157b83c4173fe93439909d7459d36bba022534c00d1cfac5eb52e6073a2faa3a6471ef16cace6b8e8694917e","ssdeep":"3072:dpiK58PBLm+JKGYmGKWmc2afaEkLZuawWM7E9:dAbm+wGYmMwazeZuaZQ4","tlshash":"c6b312724e0ea5552b2f9afc6f66abd68e468c55803ce484a4b117667ec0fd00d730bb","first_seen":"2024-12-22T16:23:43.801219Z","last_seen":"2026-08-08T00:56:42.22757Z","times_seen":30,"resource_available":false,"data":null}},"time_used":107,"timings":{"blocked":-1,"dns":60,"connect":1,"send":0,"wait":9,"receive":9,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.608Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_ebfde7c7-fdc6-4b58-9f46-2e709f79d7d7.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 443950\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JxBYcix5X4J4%2F7J6tsw7rQW87PS7kiiRl38T7DDwflq5xVRqROc5mbi8l%2BJsI7i0foanwV665zeB44LmiLp0okmZ8U2PNo%2FDtRXgi0y0386Hc%2BYE5EZagdtKdWNs\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"0a0b476de0285ffcf9a077b66808908a\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:54 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48461\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047ae1092eddc6-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 86007021-75EE-4042-9CC6-1379422866E4\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":443950,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"0a0b476de0285ffcf9a077b66808908a","sha1":"c69f9c378ad5b92541d6461966f4eb1e26b5c1be","sha256":"5facd22044586932e08dd8884be7e0df1e6e6e383fa62e4a48e15588173d07e3","sha512":"2354f610c6afb2176c92d08255f091daa234022a17d7baf02641d4599b6efe2845f87b1a5435b2967f9bed66f40ed7cb968fad0cf8a52f77aa023324c110193a","ssdeep":"6144:aJG2OHBVqe8TgOuacNjojaE3MZ84Zz61zNnHeCZWDuWGthjzDrhYunDrofVLeSkD:wG2gXt8TgfKBcZV+DHeCZjWahjDh+VL0","tlshash":"f89423cf58d732c138082647369bd27a71424367682558eccfd28c4e21987ede996baf","first_seen":"2025-08-29T11:05:53.304655Z","last_seen":"2025-12-29T08:12:31.375235Z","times_seen":287,"resource_available":false,"data":null}},"time_used":6853,"timings":{"blocked":4609,"dns":0,"connect":0,"send":0,"wait":318,"receive":1926,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_96811f47-5a2c-446d-a8ca-696df160de09.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 421125\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RbKlRHbpdRpBIMHIV4PKI2p%2F69w1k92a2cz1wjYhRlh8LBtoxDtwH%2FtYnZkPENHJa8dnRuVKFf47%2F5Eo6najgFnHCP5MxpabZC0vzWT8sbfa4ImqZ84RyCCaaD4D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ca2c40875930e080728d0dcff80c9acd\"\r\nLast-Modified: Sat, 06 Dec 2025 06:26:31 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48465\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047acedaca84f7-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 1A92E6B0-DE3E-4990-AE10-B5D889279F0A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":421125,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"ca2c40875930e080728d0dcff80c9acd","sha1":"029e9c2c8d28e246f170ee8c9e33dc0f56a90b88","sha256":"b940b7d79710788c425d36499d1d1f7cdd4b9683a003c482779009645dfaa41a","sha512":"e066766d55727f5e1831ea21e4e7539bb5a94159970a4c28d347c9403cd9fad8d5e3f7bbcb39b6a5d83c6c218f3f573644ed721ef1094a8d94ff67419da3bd12","ssdeep":"12288:HqkhMCNWKKgyxl4qXoC37KL/w2MpMw8PI:JXQoqYkKL/EM3g","tlshash":"61942398a9fad4579ce902f8e4900f4af6b351408cd201effc261295e533eed326d4b6","first_seen":"2025-08-29T11:05:53.309659Z","last_seen":"2025-12-29T08:12:31.348874Z","times_seen":279,"resource_available":false,"data":null}},"time_used":8533,"timings":{"blocked":7029,"dns":0,"connect":0,"send":0,"wait":300,"receive":1204,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/fonts/DINPro.9ee75b04.ttf","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.032Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /fonts/DINPro.9ee75b04.ttf HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/61540.1756903329400.030a612e.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: application/octet-stream\r\nContent-Length: 119892\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nETag: \"68b83893-1d454\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: A6DCBB5E-33CF-4685-A5C4-CF80F4C3289F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":119892,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 10 tables, 1st \"OS/2\", 30 names, Macintosh, 2005 Albert-Jan Pool published by FSI FontShop International GmbHDIN Pro RegularRegularAlbert-Ja","md5":"028cefac160ed3b006f47106fbc68d1c","sha1":"efcecac09684435facd7397e4f6163a5069802c2","sha256":"fb841a09a82787982ad1774bdeb45e8e06ff4909161a9ce33fd42f8822c5ddc3","sha512":"3a5a284d0c4da6593b857ba785a4ba7d5f2e2b73d22a2ef25435b9558063d2486228d76a3cd5d3a59b5abe4c0da696a75373111b3569a94a9dea1516cf16091f","ssdeep":"3072:YhtN/CZnt1tbtKtHtFNgz1QZt0tbt2ktwtNstAtqNaEctWpy8TLtsIb66AUeo:YhtNGnt1tbtKtHt7t0tbtxtwtNstAtqV","tlshash":"5ac308c153e8fa4ad83996388511c7434226ff2de65d4f36ffd94d8c688e8e9064e6e0","first_seen":"2023-05-08T18:58:40Z","last_seen":"2026-08-12T08:19:06.4043Z","times_seen":5602,"resource_available":false,"data":null}},"time_used":686,"timings":{"blocked":145,"dns":0,"connect":0,"send":0,"wait":469,"receive":72,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_ce6f5a12-ce60-4931-b7a7-3cfa94c956bf.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 112081\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=aloFk%2FbEstaImjm1djnNAujO8MjnAYjcQENt5Tw1dhU%2FsFTDOuYFi%2BqRKPaq%2FMjF82XwqaawMBGnJxZs1oTNQRoJkNOhIz1wE6RRAU3DlGmrEjfLqvhn%2B79uUdVI\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e400b1ce694e9efbda2b9479c60f4115\"\r\nLast-Modified: Tue, 02 Dec 2025 14:08:16 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48482\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a59392786ad-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 17C8473E-1FAB-4196-A367-8FFBF2CE0A92\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":112081,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"e400b1ce694e9efbda2b9479c60f4115","sha1":"7dea27eee3238d11200801bc44d1bfdf6c2a561b","sha256":"155e9244c0749d2c6891d3b541a8c081104c180e6c9308ef87eb4755ebce213d","sha512":"681dc38636b2420c7e4731f6cd2b11d483e848a64d5c19706465dfa373613c791b8caaf7b8cec746e624c00e6582e7923bf74f0d1d05dad8646f6bcabf267d64","ssdeep":"1536:CaONt1WZ4PaW32QGG8HJRfa9bjz2mt/XO8wLQmI2GOcj2B1Kudk1UaMEcS9dd0f7:B4P5eIbjz2mt/MLQj7j2B1LiUkR9dpe","tlshash":"cdb30201aed3bc913942658841e1d296350f78b2e5ba83c7edffcb0ae5911afc9d4462","first_seen":"2025-08-29T11:05:53.339263Z","last_seen":"2025-12-29T13:58:58.050834Z","times_seen":290,"resource_available":false,"data":null}},"time_used":4657,"timings":{"blocked":4351,"dns":0,"connect":0,"send":0,"wait":300,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/sponsor/sponsor_web_1.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_1.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 42326\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-a556\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nAge: 51797\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: D947E786-F651-40BE-868E-92A8D35B6226\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42326,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"e0ecbe5a9349aaa328ffd6f9515f9007","sha1":"79ebc30d345c812a3e3a122f152829d161b00a52","sha256":"452d27839b3f3f35d11c9a26f06d6cc9db56dc8c61261ee43e0512f69abf71f4","sha512":"fd322bf3ca925ce2eb45317adae1dee0f1c2e4f30035738052a97ccc054ffb576a92a46758559c8d13cff6be549caca5541d14c5692cbec2758ab2b3c7f3324a","ssdeep":"768:2o9mjFjepo5h5jLasrCO57PIrvmMOSf4t7q5bo6Wruv9CSMsfRLMD7XZ0:2ogpymTxRrwmDSM7mbo6WrutR60","tlshash":"8713f2ebe1075d80bb946c9b3925eec61da50f047bc78d68c5e055f921290bb0fa33a7","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.261573Z","times_seen":2371,"resource_available":false,"data":null}},"time_used":1229,"timings":{"blocked":593,"dns":0,"connect":0,"send":0,"wait":318,"receive":318,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/bj1.17ef2db8.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/bj1.17ef2db8.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 58859\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-e5eb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nAge: 51797\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: AFA5A7E4-4817-4906-BD0B-44F6C30CB0F3\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58859,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 1299, 1-bit colormap, non-interlaced","md5":"59f1176bd542d042d8ddecbe4ab2cbdf","sha1":"7251e6f8bc0bf8bf3e62e892b34540f8259dcf9d","sha256":"b3bc2f14721d5f84900af66179eb6ad69a9c8d5a89eae36f877cf09fc9872603","sha512":"c4e7f1491686b72482ba26e34fd94496fc71bec2a35ba1d7cf67391e1f47f859465ad9f0c7d286bd35f9a26132fd80012a2cd2f8133cf1c6013db4f4d27a85d7","ssdeep":"1536:jlJ0Z4kwI3cG0YXIPf/OWcFOtk2bnIlfyMcw68vTbD8:gxbsGvYXd8OtTbIsgTbD8","tlshash":"004302d3b5e9f610dd38c157a3d1c9da504483be3e938d0bebbe402629fd56840a6f16","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-08-10T17:58:48.525616Z","times_seen":2676,"resource_available":false,"data":null}},"time_used":716,"timings":{"blocked":413,"dns":0,"connect":0,"send":0,"wait":300,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/sports.60212fd6.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.962Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/sports.60212fd6.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 116532\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-1c734\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nAge: 51795\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: F0419457-3C09-4262-B5F7-6E075F3C9A11\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116532,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 666 x 541, 8-bit colormap, non-interlaced","md5":"fc82aa907334f929011fc2a6ec906f55","sha1":"f76bd75b9d1235807c70c7d763a1865d7c3f8d4e","sha256":"2ae1d61176960d7ddfddcb30a69d22b9da893687370d8cd26f4917d129a1bf3b","sha512":"12ef7a828d7d4228596b0db0ad77b200e8ffcfe2457d12821a4e9778b62668ebeef075c2bc79076e36291e3015afbfe276a2ca230ead018b38e2d3fd803dd31f","ssdeep":"3072:/ZEgiWqpGRwEyiwX0wgOZzbKoSxNiSvrUeO4h:/ZLf/R2iVwgAKoSPiSvVOy","tlshash":"76b3021c79775a2083c6bcb40b583aeae09b3dc19d169808d68b7791993df43c970bed","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.454762Z","times_seen":2722,"resource_available":false,"data":null}},"time_used":1327,"timings":{"blocked":698,"dns":0,"connect":0,"send":0,"wait":299,"receive":330,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/cdbb04c354094db9b1719a8ff1dde7b3?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/cdbb04c354094db9b1719a8ff1dde7b3?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 58096\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 82377\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"cdbb04c354094db9b1719a8ff1dde7b3\"; filename*=utf-8''cdbb04c354094db9b1719a8ff1dde7b3\r\ncontent-md5: O1RUPBpYTi6ZSNZVFCmW0w==\r\ncontent-transfer-encoding: binary\r\netag: \"Fv4ZYFQTMCVNpYc0ab1tJH1LCehz\"\r\nlast-modified: Sat, 13 Dec 2025 19:03:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 4xfvUf8Dl\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 69UAAACXspWwZ4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58096,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"3b54543c1a584e2e9948d655142996d3","sha1":"fe1960541330254da5873469bd6d247d4b09e873","sha256":"71f8ae466898b04bb3483c05bb32ddf6b51f074a620bf85994ec0f12fcb0d0d2","sha512":"a68f1267ec89385f47808f0e9bedf185a5050ab80e71c4ee84e05253dcb80e20267d967073144dd16997cc1edc61c61f9c7c5e34ad48c66fc39e29808dd90f89","ssdeep":"768:fJxS3d7ODki6W/Ymhoqd1KQPfR2G9D9ej5Vol2qVT+ys9RCFRurOzlkbREho7Alx:fJxUukGACTvP9R8NcYLRUsrOKbaNs4N","tlshash":"7f43f183ab2162f77ef36d4ce67c5610d2a204bfda434d97160645e6303da0f5ba846f","first_seen":"2024-12-13T17:33:29.049167Z","last_seen":"2026-05-17T16:34:28.581307Z","times_seen":180,"resource_available":false,"data":null}},"time_used":3136,"timings":{"blocked":1251,"dns":0,"connect":0,"send":0,"wait":1287,"receive":598,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/1e7bbc2f18c64b98a4f8286f8ba4a2d6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/1e7bbc2f18c64b98a4f8286f8ba4a2d6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 46519\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15785\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1e7bbc2f18c64b98a4f8286f8ba4a2d6\"; filename*=utf-8''1e7bbc2f18c64b98a4f8286f8ba4a2d6\r\ncontent-md5: v91QBIQzDWOnI8vDlt92LA==\r\ncontent-transfer-encoding: binary\r\netag: \"FsL5qmMbtQtUbU9-oX1_uLd5a5H5\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:22 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: FZnslNfcG\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 6lgAAACnz0lBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":46519,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"bfdd500484330d63a723cbc396df762c","sha1":"c2f9aa631bb50b546d4f7ea17d7fb8b7796b91f9","sha256":"dded3e4d80883f4e0b252ede1f029cd3b764eeb7928fef10fb4b0faeebf326a4","sha512":"aa103789edb020732b7040c7a7a389a2cffbb36823a250dd3de017481da59bf23d51fdecc95b988fd23188035588816984a1fd8995019870d8ac0a3111b3f14f","ssdeep":"768:SfdBtucg82/pFKJJ00Mip/vYLSRRBq9x4QhGpfrr1KU76QkFPF00uvX1:Kdus2/LK700Lp/v6SRRBcx4gGpfrr1PR","tlshash":"0f2301dede041e9e70206c2597ea950c997ee25b6f25a30398e7a4fb04f33012e61d47","first_seen":"2023-10-31T11:08:25Z","last_seen":"2026-07-19T13:33:25.903645Z","times_seen":250,"resource_available":false,"data":null}},"time_used":3230,"timings":{"blocked":1199,"dns":0,"connect":0,"send":0,"wait":1288,"receive":743,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/away-bg.00d4ba2a.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.638Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/away-bg.00d4ba2a.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 3883\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-f2b\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nAge: 51775\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: AB0CF1D9-54F7-43C2-BDA6-CA9988CA2FCF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3883,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 277 x 80, 8-bit colormap, non-interlaced","md5":"ce3e5a71ef5dcf15c030882243e12315","sha1":"d4fdd1329ecac30941a67bd5108bad525c791c12","sha256":"3c2aad01ce2fce6463d6ed3bde348515922dd019d8a670b07b53d66b39c68d3d","sha512":"f6a55d8c079529988760a1c22541c097af159a3653f5ffe89c5c31ee20371f2c879c64797319f4176be77c821294f0f72d83ad77f2a0141203c857c8f987966c","ssdeep":"","tlshash":"6f815cf693e66bd0d5675106a3a14c89624d69d925a325530923f45ec3bb1ac02fe381","first_seen":"2025-08-29T11:05:53.10673Z","last_seen":"2026-08-10T17:58:48.509666Z","times_seen":2337,"resource_available":false,"data":null}},"time_used":952,"timings":{"blocked":659,"dns":0,"connect":0,"send":0,"wait":292,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/undefined","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.899Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /undefined HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nCache-Control: public, s-maxage=600, max-age=0\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 74ADB59A-8F73-40F2-8FBC-4B3DB3E19335\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23624,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5777)","md5":"87588e90bb24e209460bdbf1bcbcc074","sha1":"f3c57be16a0eaf6879f3469c6a2db7720a699832","sha256":"61ed38427305a473065294efb15ef101340cf9d3e19be35a6c6c86083698c328","sha512":"160c240e67f56096c7c519eeb5b11bd9fcac971ffbdaecd231be6aaba4f98a1dbf5f44a22c0edfbe64860e3039a11eba5be0eb13802c82e7033543d7891a8e51","ssdeep":"384:kR7B3v2VwiYwJvSoVXsp+pa/iZcVk97g6nMusplliz:kRdviNYiKop/E6wkpcu2lUz","tlshash":"9eb2292e8df349762523703a2bbfb208797180134309ed803e4de7584fd59aa46e7bd6","first_seen":"2025-09-04T00:49:32.720758Z","last_seen":"2025-12-29T13:58:58.052747Z","times_seen":445,"resource_available":false,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":460,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/ecb/8f8306425eba6e0167bcdb25a31b67ec8f","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /ecb/8f8306425eba6e0167bcdb25a31b67ec8f HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://f214n.xyz\r\nXign: zqPdycXcurE8zR3SZIzjs9vW5cyUTFgsCks8VlSvAp1dWp5tWDfklS+9ySzWmoTTiw/oJOitCHa2jWASTSnANJK+rz2wZJcASM7g8WU2b56oLs5SAcQzZC4CA5FZb3jibLMluG0LI3/UEPKKgX5aDT9BKguokwzeSru8WKC1sms=\r\ntimestamp: 1766170386704\r\nsign: 5f7d5e3r475e4d2o\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Fri, 19 Dec 2025 18:56:07 GMT\r\nCache-Control: public, max-age=180, s-maxage=180, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 20883422-1A8E-4F18-A0C5-397B4CF7B56B\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3580,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"dd98212dbeb134c15001cc255754b38c","sha1":"b82687bcfdcb48dde510dc6dbcc9e939d52ee7c8","sha256":"ab5432574d705f035827a48b1765eb541224567f50855f0d36efb51e99b24c15","sha512":"3fd69bd2ed14f99f0a4024817e8f695177e4483ead3704590fb970630067904cf9d1504bf9519f638358dbe22e516ed80c5849f471b29485a1c4d59cd577e1e1","ssdeep":"96:eOGS7hTEAd9wDsZ/BOOoDZAPJOdb5yfSZEt7bcn1E2HiNm1KLKpUCWZIh0MMcT9/:VP7SkasxBOP64dWSacq2HL3WZgOPhTw","tlshash":"12b15cc7a2b5972370c450e1d779a4e884dd0fa4e2851c19e66a14cc1efdaf9b2af940","first_seen":"2025-12-17T12:37:55.664222Z","last_seen":"2025-12-21T18:43:59.853783Z","times_seen":39,"resource_available":false,"data":null}},"time_used":480,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":479,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/be39530f06854f0b8e92029b267044f3?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.516Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/be39530f06854f0b8e92029b267044f3?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 27275\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1005\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"be39530f06854f0b8e92029b267044f3\"; filename*=utf-8''be39530f06854f0b8e92029b267044f3\r\ncontent-md5: ZDRVwVlvM9j28bVs7ESihA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fh2x_xph9MHwsKqkB1B6_GZnqwTB\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:50 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: ZHC2bjSxP\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: V5wAAACQy3yysYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27275,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 185, 8-bit/color RGBA, non-interlaced","md5":"643455c1596f33d8f6f1b56cec44a284","sha1":"1db1ff1a61f4c1f0b0aaa407507afc6667ab04c1","sha256":"fa6020f97f34698d77fe558ed1875ea52c99b7cc6fde74a89c0eb52906cdbe91","sha512":"681e9d8a350b51c31406ec06c43a0a6482403ce6f89675bb6edb81794e13ae0474a08b135bd0482c37840a495aa84092272a2b0f5f3b5318edf711ed1c64c9e9","ssdeep":"768:gAp+Ctu+1Ywo9MxxffLr1Nms/Kpc5zsstT1Y:vEY/nxxHLZdf1Y","tlshash":"a6c2e1c7d0bed8e0d123ae5b1b84e8db7d739073a0e6066e56f14d9b684b3a78247c50","first_seen":"2025-12-03T15:57:49.666276Z","last_seen":"2026-02-28T19:56:30.154637Z","times_seen":33,"resource_available":false,"data":null}},"time_used":2702,"timings":{"blocked":1278,"dns":0,"connect":0,"send":0,"wait":1283,"receive":141,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/api/sport/match/player/match","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.641Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /api/sport/match/player/match HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nx-request-source: https://f214n.xyz\r\nXign: m1ZKP+L9D9U1rOKMFC9Q5j8Kfw9S+ow1GNKrfT2biNedEhKCZTqJVCjsf9182b6gY24uuc6Lybz/bhJndEA9HMVerMEFkVRpcf+R5BYmNpGsC7Zo+PgR0+RpLnYK67hTHKtaiXNIMbPBKS9ZtrXAd7Jm8TjgQl8qYPbxWarZezU=\r\ntimestamp: 1766170387511\r\nsign: 41a3r2s1k134a6d6\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 39700E5D-2734-4358-923C-9C86C10988FE\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ad1b5cbc37e087c212a41eca07a863ae","sha1":"f990fb40077ca4c90bbde8ffb87c73e1c06fd931","sha256":"0fca88eefe8bb5f59242b88e2b8b179148a088b4cde3499e1c56fef8c84c309a","sha512":"fe056eef22791a958cc37f63c1cc4b3f35bd990c34d1d321f34504b7b99769b571fe46cf18ede31f7ca0e564baf63aaca9d4f3601395bd7a3ce424e50a2aaf87","ssdeep":"","tlshash":"56a002473a282ea49bc31066b50e7a5500a421749a55f469cc8e623dc755453b546531","first_seen":"2024-05-26T00:49:06Z","last_seen":"2026-08-10T17:58:48.562049Z","times_seen":2693,"resource_available":false,"data":null}},"time_used":442,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":441,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/7907b142380840a7b69cec6e8b096b1e?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.549Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/7907b142380840a7b69cec6e8b096b1e?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 22734\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 46386\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"7907b142380840a7b69cec6e8b096b1e\"; filename*=utf-8''7907b142380840a7b69cec6e8b096b1e\r\ncontent-md5: JdaghAhWpk1NCL/ksfVuFA==\r\ncontent-transfer-encoding: binary\r\netag: \"FijY3--VGmzJLMca0XEMVvFleUxr\"\r\nlast-modified: Sat, 13 Dec 2025 19:04:12 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: 2ZXCZHZoy\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: nmsAAADEw5NsiIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":22734,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 150 x 143, 8-bit/color RGBA, non-interlaced","md5":"25d6a0840856a64d4d08bfe4b1f56e14","sha1":"28d8dfef951a6cc92cc71ad1710c56f165794c6b","sha256":"66232b5d87dabe42de7da49f8311c5b6f14c65b9f40cebe48b1e0f54c12e0dc7","sha512":"ee2110693daffc102a28b8302c0d47771d42c1efca84bcc5274f6a24717816121d2267631447eb5d83859c6874927334d7b77e406ec2ee7fa2b71aa538e8de79","ssdeep":"384:iZG1tBphH82qEwV2Z1gfLz+mm4osx+vMoVAVLIeHHFbEwIGj0MdIhqX3:+GhvLum6Wtr0dLfHFQcj7X3","tlshash":"a2a2f1dcd9410a15c1f789a899330ed5f0fc13b32a3609ba8f4a4b1cb9b458eded5e11","first_seen":"2025-01-17T06:33:02.146787Z","last_seen":"2026-07-21T10:08:08.192665Z","times_seen":169,"resource_available":false,"data":null}},"time_used":2893,"timings":{"blocked":1246,"dns":0,"connect":0,"send":0,"wait":1287,"receive":360,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f3f4504f6f9e4bf29edc030bec44af23?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.570Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f3f4504f6f9e4bf29edc030bec44af23?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 96611\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 22962\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"f3f4504f6f9e4bf29edc030bec44af23\"; filename*=utf-8''f3f4504f6f9e4bf29edc030bec44af23\r\ncontent-md5: Xb4yCFXjunctvOVPlAxvpQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FkxVClyyFmvuIyxXL3ATOcm--Uz6\"\r\nlast-modified: Sat, 13 Dec 2025 19:07:37 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: BycMByDja\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: kaUAAAC7j0a6nYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96611,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"5dbe320855e3ba772dbce54f940c6fa5","sha1":"4c550a5cb2166bee232c572f701339c9bef94cfa","sha256":"4d54dfdaf41ae36f3eab417bc2a6032abd81e6462e7058cbdbacda9554ff9a11","sha512":"c13c63d288f58fb5280a6f6f176ff936378b55789698412a37a243efc361a45d7f1073afc2fae6769f3be3b31a4810493152071a54eef49006369e7d956b59b2","ssdeep":"1536:iRHNNDu0oVeTTLcpOkYuC0ljr8bfoXGfli/KxJ3Yo6AcAB1GftrQYi3Xu97jT3qY:iRvDfoYTnLkDC0lfdXGflIKxJ76A1Gf/","tlshash":"fd93025002754f6f048d729bb82ed09d9c427598d1a0bfa478e5b58470e4b8e7afcece","first_seen":"2024-12-26T20:26:09.843276Z","last_seen":"2026-06-05T22:09:33.476463Z","times_seen":307,"resource_available":false,"data":null}},"time_used":3355,"timings":{"blocked":1225,"dns":0,"connect":0,"send":0,"wait":1287,"receive":843,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/30475d809d174be8b8d5a1de93a17988?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/30475d809d174be8b8d5a1de93a17988?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 41532\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1005\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"30475d809d174be8b8d5a1de93a17988\"; filename*=utf-8''30475d809d174be8b8d5a1de93a17988\r\ncontent-md5: QsDUS/QOHw1gtU2walxsyw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fj0DVadT9vKUG-ULMpE4juwNS9dl\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:48 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: 5SG8K3bq4\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: fp4AAAAaZn2ysYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41532,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 220 x 220, 8-bit/color RGBA, non-interlaced","md5":"42c0d44bf40e1f0d60b54db06a5c6ccb","sha1":"3d0355a753f6f2941be50b3291388eec0d4bd765","sha256":"27e71e19984f54b1b78ceb9dd64381013c7647ca1a89a1583c0984a30fd763b9","sha512":"6cd334e38793798ada206c6cfe75f17cb90dabbe314549b34d8b27ecfcb5a38c0b698958d0d322393ea5c691c9c7939bdd299fce68c26f6c30bd5502588f2d30","ssdeep":"768:oIMbVwTaFMTG8ivm8m/L/JMC3zmFdzjkfhDQPRlPuDoFlsLfwmRw:dwYoMC7vm/jhMC3z6dzjK0PDPu0oI0w","tlshash":"c813f1bd64ed123de2bd68f4fd68e8712de0b6ad4e77251553808109ee0d12b4eb4728","first_seen":"2025-11-19T10:34:21.926214Z","last_seen":"2026-03-08T18:23:31.007919Z","times_seen":18,"resource_available":false,"data":null}},"time_used":2885,"timings":{"blocked":1281,"dns":0,"connect":0,"send":0,"wait":1282,"receive":322,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_6ba5f6e7-0a03-42b1-aae6-3de33d838c71.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.611Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_6ba5f6e7-0a03-42b1-aae6-3de33d838c71.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 441285\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=acI8TJSQ0XtUBe2IbhKUGfxIInl0RbF2uMgRqn5PhcA9AS546%2FN8yRJKUs%2FHgl7LsNKnnDHs%2FjonLfZ4XAu0RMdtr0XgC72CdLyhfQiQA1O9Ls7ignghY6ri7AsF\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"5cbd1adda9f772a16f34c0a26b141c20\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:35 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48475\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a861d1e0893-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: F8C17030-ABCF-4BFA-953A-4F7897456C94\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":441285,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"5cbd1adda9f772a16f34c0a26b141c20","sha1":"3d829154f18db91028e797aa4f7a3bc27c0fb5a3","sha256":"cd182233fcca00c129d8b8cc6a71f285b7ab087ba40292106fa03f470d351100","sha512":"2985899304431b84e38d588c430eabcd09bba19ced9275f0900a35495404c21e4a208775b18cf6450eaf0499fe3f10fe06d9bbd509a094f311a3090399fa6d24","ssdeep":"6144:vQ3IELp1ifxXQrauVNCK8SmnYIzbSM6h7fValiX/HtPnSxjr/CaOwwKd7SORGEen:I3IA+oDES4TiMMt1X/YzJOwBXeogJTp","tlshash":"9e94232be93505e99e8306337aa7f320edd099c82c062423d15afbf197c4c64b7d95da","first_seen":"2025-08-29T11:05:53.315748Z","last_seen":"2025-12-27T06:51:48.749594Z","times_seen":285,"resource_available":false,"data":null}},"time_used":6267,"timings":{"blocked":4816,"dns":0,"connect":0,"send":0,"wait":290,"receive":1161,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/0b680e37f8fb4a659d6d80bc8207928c?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.634Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/0b680e37f8fb4a659d6d80bc8207928c?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 45719\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4971\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"0b680e37f8fb4a659d6d80bc8207928c\"; filename*=utf-8''0b680e37f8fb4a659d6d80bc8207928c\r\ncontent-md5: wgULlAB233CyrQphA8UN9A==\r\ncontent-transfer-encoding: binary\r\netag: \"Fsi3PtLwb_W6rQKTpfM7PXT3jB2i\"\r\nlast-modified: Sun, 14 Dec 2025 19:03:48 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: T5Yys0Kai\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: JAEAAADiFjYXroIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45719,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 296, 8-bit/color RGBA, non-interlaced","md5":"c2050b940076df70b2ad0a6103c50df4","sha1":"c8b73ed2f06ff5baad0293a5f33b3d74f78c1da2","sha256":"ade088695e45ef6eb59e787d23a6d85e87c102e22ce9866f0f033a7bf6a423d1","sha512":"5961580533a19a85230d80691c74584df145d5be4e984a59230a6cb2fe89db13f814c079fd7ef810036d447356cc1b54875002e0612a2d1881dca73a5d1b44d4","ssdeep":"768:sNrHq1vd6Yyad3pPlpvsYB/l2YrWGNsYgVfXfR64q7WN4k7URFIJtyeJc:iKNhyadDJsYFl2YaYgV384qaRUqJc","tlshash":"4023026d84ec58b03bd34464fe8d5b98eefe4e3597699b12208869737d8c301b26cc27","first_seen":"2023-05-27T18:34:14Z","last_seen":"2026-08-01T15:49:37.298638Z","times_seen":193,"resource_available":false,"data":null}},"time_used":3220,"timings":{"blocked":1168,"dns":0,"connect":0,"send":0,"wait":1296,"receive":756,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/1d0483b66b6f43bbb2aee88536a2d8a5?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.511Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/1d0483b66b6f43bbb2aee88536a2d8a5?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 12011\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 1003\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"1d0483b66b6f43bbb2aee88536a2d8a5\"; filename*=utf-8''1d0483b66b6f43bbb2aee88536a2d8a5\r\ncontent-md5: KgR7eHp6Dr9em7J5YGOPJg==\r\ncontent-transfer-encoding: binary\r\netag: \"FmvWD8dBIXSEdqlsEF3lHyjUdAWD\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:48 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: wvpNJwJrn\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: vs0AAAAQ3P-ysYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12011,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 140 x 150, 8-bit/color RGBA, interlaced","md5":"2a047b787a7a0ebf5e9bb27960638f26","sha1":"6bd60fc74121748476a96c105de51f28d4740583","sha256":"632988b872dba81bb2f949ae0cfadc20a48ca60e02585ae287592b2f63d65e8b","sha512":"896b3552b4fd4bdd33825dcb82c34d844da49b19473c66369b4bbcaf82fe988c1927394ad173e17044ad80a9ae5eaaa8caea0c96cc6c908004689d20428aadcf","ssdeep":"192:AS3MZit3DgK356Yfuvhe7yWGbgsJbJ3QixSd2Uae9V96dMb84xKMvXXxx:n8Zit3DgG56YfYe7DJsJbJ3md1a4IGIQ","tlshash":"b042e0245919f05dfd884413ec3ad10b9ab538f3a572f8819f787829af060ec9eec853","first_seen":"2025-12-19T18:54:13.830598Z","last_seen":"2026-05-28T21:09:42.200575Z","times_seen":23,"resource_available":false,"data":null}},"time_used":2678,"timings":{"blocked":1283,"dns":0,"connect":0,"send":0,"wait":1283,"receive":112,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/bca3b9a7cdc44d1489ccfafc251009d6?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.485Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/bca3b9a7cdc44d1489ccfafc251009d6?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 16426\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3168\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"bca3b9a7cdc44d1489ccfafc251009d6\"; filename*=utf-8''bca3b9a7cdc44d1489ccfafc251009d6\r\ncontent-md5: sCM+wNyxbM+pozSp4X/YjQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FglEnPThaxH_MeyK4DTBUrp42nGD\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:44 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: z4OVmuXQV\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: VikAAAC6fPa6r4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16426,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 99 x 99, 8-bit/color RGBA, non-interlaced","md5":"b0233ec0dcb16ccfa9a334a9e17fd88d","sha1":"09449cf4e16b11ff31ec8ae034c152ba78da7183","sha256":"9c56520716d1f8cf7f78b96b541f0de006d4de78ffe57889b1f4b7a0414b1b81","sha512":"acc54788686aa05ce3bb94e8b440f06213a4021c056883cf64940b56e561c5b0af007181d211ab7b8dd97cb3b2b67c0359b74cb6b5912fb0a2a81c95749de25f","ssdeep":"384:1A9Xe9D/9IUEYWkU5AOpSoShFU2GNrw/P0bFJzljw6tf:1VZ/utREWSBmxlwH0bFJzRf","tlshash":"8d72d0ed51258b2b37113376baff2055ba59e2e1836316f4488956323d0db10539f2f6","first_seen":"2024-08-19T15:01:26.215961Z","last_seen":"2026-05-01T14:24:54.774387Z","times_seen":26,"resource_available":false,"data":null}},"time_used":2503,"timings":{"blocked":1309,"dns":0,"connect":0,"send":0,"wait":1193,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_df036cfa-66a5-49f7-b863-3c22d1a3d180.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_df036cfa-66a5-49f7-b863-3c22d1a3d180.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 178321\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dHacelgAw4fXHHiHjq6IJxgk7vrOfGNCFd7uS5y6%2BsrNpu192g1QrmF2bjV9EFCisVovOSLXvrBgEWpzPPnkdAX%2BrhwcaOanzMQUy1Am%2FN8qGJxpRtAigxXWeCZH\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"0ea328c6532c94300f5a04740a02fe5b\"\r\nLast-Modified: Wed, 10 Dec 2025 11:52:18 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48476\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a859baa04f3-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170394=Nz/+pSZmaO2C7uXGVyo7DBMkcXHGCcUuHmaPtLTQSXXLpvwIEjYbRDsDBkLOVqPuf9OO8cBm2gBYUxJ437Y8TlbdnSLR8QRLsz+VHrr7fKeAWVvF5ScDjC1Xk6Vq6nfHSdhffhfE9vkWD6cxZKtT1AJGoe4WIf8+VJGatPaoUEhG6OP8V/thIabrnWnKspXM\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 4E868B5F-61CE-484D-BB50-67A276C197E5\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":178321,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"0ea328c6532c94300f5a04740a02fe5b","sha1":"16f14cac5cef78adb3252d74ed3078f0ec546b12","sha256":"3cc57ac046b82d9864901bd1695acf13af777d3a4d39a29ff1aceca181cc9b84","sha512":"9cbe40a96c2598c11bffd5c812f6921c85a2ac1aff362bcd12bdcc345a892cd5a0df6e0d30550a3a1a1856bed1595d71c88966514d42886f76b5bbb6b5aed3d5","ssdeep":"3072:5nMfyun8IhspJcDnsyIKybNZZ8a0hobkT7ICDhSxrQHcAV:FmyDIkJcI18ebeNHL","tlshash":"8f04129aa304dfffdb7d2e331d6a221762530be0cd07c85692f676a1401702495a3afb","first_seen":"2025-08-29T11:05:53.32569Z","last_seen":"2025-12-29T13:58:58.060926Z","times_seen":293,"resource_available":false,"data":null}},"time_used":7010,"timings":{"blocked":5518,"dns":0,"connect":0,"send":0,"wait":297,"receive":1195,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/heying.d446c85d.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/heying.d446c85d.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 1425\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-591\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nAge: 51795\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: E43B0679-6668-4E66-B004-D6CC977DBD7A\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1425,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced","md5":"c0d0c516850381dd1ca39dd94b08f21b","sha1":"54522affec52debd9c0bd3784f0ce9bf692f5d6d","sha256":"301cbb9a8c3fae88d732c8b8fdfe40113e3257831d37150e95564cc0f9b8fbe7","sha512":"6d6b1263f2de2b35237c784fd0aa127c469f8b6ebf347ff1987d791611d5b36f0909f3a81f9db6b1571756ecae60454d854e776e5ed782acbdfcce4fda2b9c86","ssdeep":"","tlshash":"dd213b5023742cd0e8ae3457ef12e5fdb823417994f8dd0c99b9bc3e84908b1057a48e","first_seen":"2025-09-04T00:49:32.953523Z","last_seen":"2026-08-10T17:58:48.227911Z","times_seen":2285,"resource_available":false,"data":null}},"time_used":881,"timings":{"blocked":581,"dns":0,"connect":0,"send":0,"wait":300,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_ad0ed5ff-8fa0-4231-a619-ce0616ad2a8d.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 437541\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hv1LGUVu2UkPx0Vv5q7tsCzQj8lie6zXvnRHvIbTL2SZuz8OZ0xEtQbzi3rCE68hQf5qrwhyGBMOzJX3Ly5%2Fc0waetA6VWBTesMLL6QtRi4IFklIcsiTQpZWL2Pv\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"022efc3205a0b1288fa238227eb86951\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:09 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48481\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a5f4e980446-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: AFC80041-D56C-4450-9189-49A4B9C97B75\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":437541,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"022efc3205a0b1288fa238227eb86951","sha1":"199eb2260e9390258f0fe010fe69365aff31a927","sha256":"d19ee176da9545bbc2d1463e31a456643804b2acc0382b4b8a6952924d15b536","sha512":"310ca94418c0c0559c34e7fb749fadd579d86e2e6d3727fb59ccf3446e54d0e2bf881283202bf0d342578af036c0384a119554cf89623afdcc8bb46498969e3e","ssdeep":"12288:4iXmQ8+GAh49y1xGL6uHhEI2qt7VMv06R7nLQItYg:4MVTp4+xGHhhxU0KnLQm","tlshash":"a29423f9140d9b6cb37673d5fc549dab26b0301fa63214be198259c70fcbd99c2ca226","first_seen":"2025-08-29T11:05:53.238055Z","last_seen":"2025-12-29T08:12:31.323425Z","times_seen":282,"resource_available":false,"data":null}},"time_used":5483,"timings":{"blocked":4607,"dns":0,"connect":0,"send":0,"wait":289,"receive":587,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_0b2c7f25-c17b-4d07-adb1-68f1823633a2.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 17930\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZrcMWRPOO52Yr6mbEXG4Lnv%2FJJgnpWsjrthK3DVnx34nYmOM10xSMFLhWxiC%2Bzga%2FIkXdzIWUi92xG30%2FenmnpKPOgdJ7RI%2Bmw98Leyer3znreuL4Q%2F1hrW6nG%2B3\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"20f2a955c113cb54ff31889b4b042acd\"\r\nLast-Modified: Tue, 02 Dec 2025 14:12:03 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48473\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047aa0bee885a3-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 8DF0822C-64AA-480F-8102-2447A8B6FC0E\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17930,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit colormap, non-interlaced","md5":"20f2a955c113cb54ff31889b4b042acd","sha1":"08d9f6359743b39286cd78531671d615884b616b","sha256":"660aadafb61000d1d9b2e9e90096092fadb32dc8ef671b25ad5014bd47dc5ae6","sha512":"e6f587ce2b92baf6ffbc0de68413ac2d3af7f3c01ac9039a23a21b5beb2835194260ae1440db3bd75a5419db91df6a265adbf536abfdff92665bb476b66ea3ed","ssdeep":"384:jtp0ai9STNjk9ZZZL3Gt+m4OZZ6r6ZuImcZtiknaMu9Ov0:UaqSBjk9Z3G+m4OZor6rmcZJZu9Ov0","tlshash":"2682d00a499faa97dd8bf53bf949660208c1804a282dbda394e456d3d678dd4ca3313d","first_seen":"2025-08-29T11:05:53.266681Z","last_seen":"2025-12-29T13:58:58.061767Z","times_seen":295,"resource_available":false,"data":null}},"time_used":7129,"timings":{"blocked":6839,"dns":0,"connect":0,"send":0,"wait":289,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/config/initGeetest4.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /config/initGeetest4.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-3a06\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170382=fD3dUXvTAvqkKlHn3bIXCn0ldYgCieEWsInrTrUy2OYSNeSM3Ocx74L28Ir9Qu5IZZNTVdLIdSEvgdjLQMGdKY8rAwJgkpF4uDVhyWLRwemAIwfZs+oHw1mOuVEVgwYh/ydxqVefveJNFmABhM/gLFLt+3W80dYlTLRrtHmJoHD8gkh4JbcBxTMn6BGv6EQe\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 4AD89FCA-E590-4A07-9E9D-44857E67C654\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14854,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"8c1728fc2d381e145b190ab70c9bb0a1","sha1":"0b96f2760bd9ca0f1d9ffaeed79934edb645cae2","sha256":"6d0aaf3dd58610ef691fb625d47237f756c4821be2dc28950c94e8eaa7761edf","sha512":"df586fb362b77f15f597573310941d008233942242914d9791e6a38e0a642874843b4f98b66d2ffd84be5fe0a986968aaccecbefedcccc7831b559164b3724c2","ssdeep":"192:hN3ar8HuCDoNu5dq+ExNiqc4K25MB5VsaiQxta4SScQVy8QRHIqaawzjTki59r8j:fJe61XHlii5aI2PG4lyUIVKQTwwwlB","tlshash":"a762104d68f750a35553b43c8b9fa014b5388a93041cde41be9ce394af9843d9bbabdc","first_seen":"2025-04-08T11:24:52.26859Z","last_seen":"2026-05-23T23:33:56.909269Z","times_seen":2066,"resource_available":false,"data":null}},"time_used":445,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":444,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/dca67f22db5a49a6bbd4818eab0e0020?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.582Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/dca67f22db5a49a6bbd4818eab0e0020?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 51527\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 21160\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"dca67f22db5a49a6bbd4818eab0e0020\"; filename*=utf-8''dca67f22db5a49a6bbd4818eab0e0020\r\ncontent-md5: ZjmLEI57ywYdHKghH/C1zg==\r\ncontent-transfer-encoding: binary\r\netag: \"FsZrLfkjozBcY_XF_KIkDuIsiQWb\"\r\nlast-modified: Sat, 13 Dec 2025 19:08:06 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: SAuLBsbFG\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 0XAAAABpp_hdn4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":51527,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced","md5":"66398b108e7bcb061d1ca8211ff0b5ce","sha1":"c66b2df923a3305c63f5c5fca2240ee22c89059b","sha256":"86d3f8a5484859aa9f3077e84a2e58cee188eea21029c5b2ab3f951198c68b66","sha512":"45d115baa1e3eb1448b41217d39d91b8a76cd5a8775fb5b11f68496d5ce6cb203a73ffd42a34f48b705e6c218b1ffeef748f5e07243f6a6e29686b1b6d3975b3","ssdeep":"768:IuwFfqZ7UIj/Lm5VkfX3aucT3PHWUACPbXRa68U4c24C4xYI9IJ0+F05IVIxOE:qAZAiiX6QPbXH8Wa0YzeymZ","tlshash":"0833029185807083d42807693bbb8a15f4eef73104bdb673107f58f90dd61aa77669dc","first_seen":"2025-08-24T20:26:12.889968Z","last_seen":"2026-05-17T16:34:28.414423Z","times_seen":213,"resource_available":false,"data":null}},"time_used":3204,"timings":{"blocked":1214,"dns":0,"connect":0,"send":0,"wait":1288,"receive":702,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw3_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.570Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw3_size1164x872_0e80d399-2c93-4f64-89db-61a96d3b05e4.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:11 GMT\r\nContent-Type: image/png\r\nContent-Length: 216312\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gp70LvhN0X2RMurRD%2BRg6WmIvc6QTDwvxTgDWAArvEsjfQm974KQ6lL10i3ADWOGfLhsOGblk%2FNwaenFTin8OH5sBoQ0G7IdnXbwzzpRq5fAu%2BVhvVDHHwFUog%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"4a57e212f11798f459137139c2f5bb01\"\r\nLast-Modified: Sat, 06 Dec 2025 06:28:14 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48480\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a5c7c138b75-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170391=tUOZ8RdTGViMVT0qRVsHCkEd/bDSrV60ZM36/1fg7dt4ymzJSog+mHM4PBbyfXIj2cVUcwU+RjuOWIEUq07ZLMXkXynq8W+d7yA3jAb0vlIqzxiyuLdsPuMnf0EFrtUwzrvVSH/Y3ArQqqkbbBowjMGG+qwqGfdwYBD3k8xlLq7ltX2p13SyD4ww+LGigZTL\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 3D6193ED-4AFB-4325-B782-C8D66C4D17F8\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":216312,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1164 x 872, 8-bit colormap, non-interlaced","md5":"4a57e212f11798f459137139c2f5bb01","sha1":"0ff7a4bf94e0d27bca7e36651637f02900f4cbc9","sha256":"947dcc120d07e5be157b5e2122b563b2291e17bb797e4f253b9b721601296412","sha512":"6a2b161befcae34ceb4835b6435adfe769896ccbc56214410545d6def652290fa13df00d80490dd6111176f53b24bfbad359ef40741239fc201b5a1f0a0fcc3c","ssdeep":"6144:/nUGyYD33U0fwEG5JaO2SXnoTlxXQ7k0kYY:/nPHU0YEGPk+o5xgkZ","tlshash":"f62413abe3f3e57eb17456350ed57b6c92f23e82a3611d152ec361d2275a930c31ac60","first_seen":"2025-08-29T11:05:53.081023Z","last_seen":"2025-12-29T13:58:57.986615Z","times_seen":294,"resource_available":false,"data":null}},"time_used":3710,"timings":{"blocked":2549,"dns":0,"connect":0,"send":0,"wait":577,"receive":584,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d4f11577588a4ba284fee4489bcd760a?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d4f11577588a4ba284fee4489bcd760a?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 22891\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4730\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"d4f11577588a4ba284fee4489bcd760a\"; filename*=utf-8''d4f11577588a4ba284fee4489bcd760a\r\ncontent-md5: qxsZJACFzE3vfUCVC5DiLw==\r\ncontent-transfer-encoding: binary\r\netag: \"Ft4bbYSknk_wGoGg604feEIMh0lg\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:33 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: jfliNc64m\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: 17cAAACVEQtProIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22891,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"ab1b19240085cc4def7d40950b90e22f","sha1":"de1b6d84a49e4ff01a81a0eb4e1f78420c874960","sha256":"04c674e1582502e60f0274480b64a1cd3c44e660938e580da08804ca4a7cd885","sha512":"cd09708bea77bd9d620157a3f74f8154e62e94af0f66c8db6c9f82386174483cb0fe5da1a260b1b1a41eb9b6bac78415ee3319cb23dc554966327580657aa8a9","ssdeep":"384:EcqR5ct//j2IPTPfsUBcVtoN/dIvOPOveG6SEPYCTsx8VvV0PKfH/Hj7F:Ecu5S/j2IbP0scLoE1uSEPpTsGsPKfHt","tlshash":"10a2e05c85e110f4e312cae24a2e3d5834b3600b9a98db79548937bd52fab7b9e171c2","first_seen":"2025-09-10T21:20:50.481253Z","last_seen":"2026-08-08T00:56:42.322625Z","times_seen":15,"resource_available":false,"data":null}},"time_used":2241,"timings":{"blocked":1341,"dns":0,"connect":0,"send":0,"wait":862,"receive":38,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/help.4e3cf897.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.983Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/help.4e3cf897.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 10322\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-2852\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nAge: 51798\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: E49FA92C-1AA5-48E7-A49D-0151EF2E338D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10322,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"6dd52a6a4d07f2786b1926fac1b4b06a","sha1":"9c9908204401fbe65d33cf7df8881639d6aea37d","sha256":"e02471f47b506ab510d0e0dc4224cffc03c34f950b649ce347ccd71af0bcf0ab","sha512":"fdd52f532e5c2e2c182db20e2053eee0ca8c26cec51ff75e1bc341b01911461ac72fa75887fa3114188ba32aa6341c0974d81d071fc42b605e72f73dfb87ab9c","ssdeep":"192:x0C+pMwjX2XZ456BAJu+1KzdjCfDrRq6wUPlJyh2h4PAmWP5yQSkHxfYX32H5TRm:EjGXZau+1MjCrrRLlqGOnWcQSkRQX3IG","tlshash":"3822c054370836084f737a4362ac4e837a06040ffdf9b7919a6372659a5b94e44cfb66","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-10T17:58:48.367491Z","times_seen":2605,"resource_available":false,"data":null}},"time_used":2340,"timings":{"blocked":2034,"dns":0,"connect":0,"send":0,"wait":305,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d77f1ed6bf2c40f39452b5c78a9dfcae?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d77f1ed6bf2c40f39452b5c78a9dfcae?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 31198\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 82377\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"d77f1ed6bf2c40f39452b5c78a9dfcae\"; filename*=utf-8''d77f1ed6bf2c40f39452b5c78a9dfcae\r\ncontent-md5: QbD7X/I/2Lgipn1ToSeSOA==\r\ncontent-transfer-encoding: binary\r\netag: \"Fv_Yz2VvzMIpoXiD9VN58R6_OzwL\"\r\nlast-modified: Sat, 13 Dec 2025 19:03:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: NVAcdXJYM\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: VsQAAADbrMiwZ4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31198,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"41b0fb5ff23fd8b822a67d53a1279238","sha1":"ffd8cf656fccc229a17883f55379f11ebf3b3c0b","sha256":"d936c13d03d4a3fa6a2637b6801ba58c13b5348118e59e0a7a31f3abc11bc475","sha512":"eb76d45172c1244eb91fcd3037ae0e295b8032611ca7b7df8bf501a8e3d6611d44ba3c82a0f82cfa80ad9ec62b25a31e389eb7b08dbc4d44ffbf3671ea89a49c","ssdeep":"768:sDl722XiRnthW18dN17gL9BkU2hc1KE0Uzo:ElSCAW18nqZohc1KET8","tlshash":"60e2026408ed8599bcf2a4ac5ef3f430edace8bdb60ed14148374b25514aaf7615064f","first_seen":"2025-02-24T02:30:01.443545Z","last_seen":"2026-05-17T16:34:28.416304Z","times_seen":316,"resource_available":false,"data":null}},"time_used":2935,"timings":{"blocked":1250,"dns":0,"connect":0,"send":0,"wait":1287,"receive":398,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/CHESS.80cb714e.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.810Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/CHESS.80cb714e.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 58759\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e587\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nAge: 51782\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 8DCBEA58-4992-4AAC-ABA6-558F1782CB2C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58759,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"727b4dc207a4141335b27fa73f76fb10","sha1":"bb63b02e635f5503d76c4fc3532c2c652a06cac8","sha256":"5d840214ae46c94540df7d0a94963cc398b32c7b868edddb6a4f2a2faf113e42","sha512":"c1512f9d9a191ea10e806fe3a8f812f78dec9832568373b7b5362fafe9aef6783947d248deb2fc8d30ba1c61fd3b94f308298e69c1de32686110fa35f7bd4ed4","ssdeep":"1536:gtPCh483gu6aLw9AJeteTzkprgTWEHbP4BzrJ:344U9Xte3kprgKE7gZJ","tlshash":"0543025a13c1159f422f37b8148758a6d8154f9f38f32ea11a9e2afda58cb0af431c3d","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.378297Z","times_seen":2374,"resource_available":false,"data":null}},"time_used":826,"timings":{"blocked":513,"dns":0,"connect":0,"send":0,"wait":311,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw3_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.549Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202506/_raw3_size1260x1156_03543abb-5967-4969-b0c5-87347b24c4d6.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 300115\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LG%2BuCwBQXMNE0nvp4sFoKHq8AIbumUk8nzNttUo193RCHgjVnYypf%2FmrZ4zf34t19gbZCjT4f6M2xuwhkL2HKqml0FKvFeSi6WQqgt3VlEsrTId0G1UDiVWpyA%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"37fec7c80a51688c04f77c1037326004\"\r\nLast-Modified: Sat, 06 Dec 2025 06:31:52 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48464\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047aae5bde1c66-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 2EF013FA-2B02-4722-BCFD-52862F0BB5D7\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":300115,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1260 x 1156, 8-bit colormap, non-interlaced","md5":"37fec7c80a51688c04f77c1037326004","sha1":"fd665b933bab23652f0cff470fba5592d3b74474","sha256":"b2b5ae8374cea37ae3d437a86c3f7149cfc0620470c5dc46a606a2858c9ea805","sha512":"4628d46516b68b86a355a4e48f93e3e662e57a75a061037c5bc151bda4ab7e9521cb9d7a41e2e61796c4f933c6d063fe5aefa99713532591a1a471f7147071a6","ssdeep":"6144:b3lXZwKOHfoPrrp3/CkvaKB7dufM9jn8J7ReuTXVGxwEk1av3YP7Ll7yi:b3hejHfoD9frj9j8J7RbXV5R1A3M3lx","tlshash":"215423b70d4d2a3be017d2f40e9f294a80955e91dc868270affbec95ca7777880749d1","first_seen":"2025-08-29T11:05:53.270915Z","last_seen":"2025-12-29T13:58:58.068155Z","times_seen":289,"resource_available":false,"data":null}},"time_used":901,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":603,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_2a74177b-d024-4ea3-8b58-fce53f91051b.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 483349\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LwQlHn4R8s0fSyQJAQZNvtcaICaG8F5RueQO3AqcnXvIB7wjnOjuaOxWjcOd%2BQC8n3VEERqsv7lutEYXfXYe1J9dYKCbrIsyCdI1ng8dUBIB15I6KIwTfxY8qg%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"20cb497720893e4fbb1e23f7820720b8\"\r\nLast-Modified: Sat, 06 Dec 2025 06:22:58 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48475\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a84fa60dd62-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 9E4DC020-C01C-4489-B15C-B6AB0D6CBB5C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":483349,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"20cb497720893e4fbb1e23f7820720b8","sha1":"c28199286ab1779fe69337d7e544caea3e1bfcf9","sha256":"e53e2e36299deb515827b23a503a4385192ad394c3c1cef219ad0615a941ec87","sha512":"afbc4206f4ddb37ff5cad057c7e0c5c79ac9cb49269f462a864fc177fcb5831f7c5b7facab8d3e82e3462514f2e886524759016e3bbe4265997b5b11b7a090f9","ssdeep":"12288:sZs0q1JCpNZTUEAee80UoTUaaDy8Vcn/QeRXXAiR4KZVTH:sZsV1QpNNUHt8wQjkoOgiLZJH","tlshash":"0ca423a8c90ff46632a7733eae2f1b981d112b44d0ebb75c805fad815d5ff7250a8849","first_seen":"2025-08-29T11:05:53.318971Z","last_seen":"2025-12-29T12:28:25.247491Z","times_seen":286,"resource_available":false,"data":null}},"time_used":4906,"timings":{"blocked":4585,"dns":0,"connect":0,"send":0,"wait":297,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/10a7457026bf4e989a9d591eb48141c2?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.588Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/10a7457026bf4e989a9d591eb48141c2?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 27217\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15786\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"10a7457026bf4e989a9d591eb48141c2\"; filename*=utf-8''10a7457026bf4e989a9d591eb48141c2\r\ncontent-md5: ZQiUbJpf4iqHhLkFsl6MeQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fg4UaIZrZbDVorodZPl-Wr9UreyW\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:23 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: Mey6VcDgZ\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: xS4AAAAo-DdBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27217,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit gray+alpha, non-interlaced","md5":"6508946c9a5fe22a8784b905b25e8c79","sha1":"0e1468866b65b0d5a2ba1d64f97e5abf54adec96","sha256":"893c1114ae76ae3a992db25f75b2f788b0b4b0239d06a02a02d254fd6be71485","sha512":"0bc956d3d26a7853dc611e4c7d3ba5685b540665040adec770f3ed02970b6124e8a0a970aec13056a8bcd5a81aa10897efeb6837b01432003fab1feb15d2bbe4","ssdeep":"768:ZCG5epoj42Sf3AQoGrc1GDUyomPUmVZckFfjKKW/:ZNMy+fwvqoVQXjKKU","tlshash":"6ec2e2e68c147b28629bbb5e8cf93b40c57315978cdc878c552153c83a813b641c3bfa","first_seen":"2024-12-13T17:33:29.045823Z","last_seen":"2026-05-20T08:35:52.502462Z","times_seen":314,"resource_available":false,"data":null}},"time_used":2934,"timings":{"blocked":1208,"dns":0,"connect":0,"send":0,"wait":1288,"receive":438,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/a7e49dbc-140a-4c02-81cf-e55cd0108e5d.jpg","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.120Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/a7e49dbc-140a-4c02-81cf-e55cd0108e5d.jpg HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:09 GMT\r\nContent-Type: image/jpeg\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hJwsYNHprZs9rw1z3LpIhNOQPXz5pVDCfhsUiELF0iG0tMdrcleeKxkhK7WchC1GHtT4Edf%2BMTrJqkURnBwX8wWsfuXDxDuS1X9M%2Bb362vzfY9iDqeK6FXf0%2BG8T\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: W/\"f42e0fcaaf4b3dd132c5b52a7fa29773\"\r\nLast-Modified: Mon, 25 Aug 2025 10:01:09 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 78292\r\ncf-cache-status: HIT\r\nCF-RAY: 9b0919e8cb9a047c-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170389=idzLU/VnowglBgoqJE8E87wM7N2x/XjzHcgPl1shS4I1xcQPPmlzEkFuT2xu+AD7F4ZtTRdDfIH9Us1jlpRGvwS2rGSsoDgxnfRyd3GWrGiywCS9NNen0IIc+8Y2KMwSzT/mRYytP7KLkipz1SkQ2QNVsFqqQ7BWDLeOVIU+W/pttwEmcpHTO5VhtAMg9t42\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 656DF5F0-1119-4BA0-805D-2BF52379313E\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":221858,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 540x650, components 3","md5":"f42e0fcaaf4b3dd132c5b52a7fa29773","sha1":"23412150020e5af9888e58038f823dba9073027d","sha256":"1f0221df43cc57f4baa91484c6d4d1eb8374623bb21dafd74c526f95942153f5","sha512":"716a4b79708b5efc807da4f3f4554531c044db894cab68e14b5854fdf342d363fa588fa4fbb045b3b729b06e7f8df9a1619183277f6f90228c2419ab7f48c9a8","ssdeep":"6144:DtRn09SU2N018YMl2/LwukXqlZU06QX3H0x:D09SXN01XN+ql+0pUx","tlshash":"8a24129423536cd1fcaedae079d87a0b3a5626fc90fff44386144a81635ebbc618171e","first_seen":"2025-08-29T11:05:53.340749Z","last_seen":"2026-03-18T12:35:39.054225Z","times_seen":1134,"resource_available":false,"data":null}},"time_used":2133,"timings":{"blocked":1474,"dns":0,"connect":0,"send":0,"wait":493,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.558Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_ca5ef219-cb88-4c5a-b68c-c85984b21465.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 516108\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ID9huyugURn7%2FwQbb2BLenlQcwH9H0lbiElbhd4yqMjZwdmwPodc3ZAH1cXZnQlUHvoFp2ixjxU1EGyOALk%2FZvU40kTbbsrri0wNbc1xpG1BxrH2at364JDDrF17\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"d4d5aca2713343207ffbc99596a6f753\"\r\nLast-Modified: Sat, 06 Dec 2025 06:32:08 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48474\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a6b98d21fc2-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 58B3B9D9-1744-4CF2-B0C0-2EAD7B657A4D\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":516108,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"d4d5aca2713343207ffbc99596a6f753","sha1":"931979c1e821d667ae318f26cbe7c7aaf7da6912","sha256":"f6b9d3f3612c0f2a397af6b94b94a38f4a2dcf82721ba9854ad7fccb9e568135","sha512":"57bf6b1df3237f5309de2aa4701d7ed5033dd815ad39d275d714c38e9e583b1264bbe89007422128be8e3987ee97e01d439752b61e61a13fba439e2bb8e6c8f2","ssdeep":"12288:h3QBwTSe071RExxzDaLj3xyfVG4LZ8hWt:tQBwTwexV8jH41j","tlshash":"3cb4239c8495886887b8e519da4f999c33c7dcec3d4cf29312e867950d0ffc80ab99d9","first_seen":"2025-08-29T11:05:53.138924Z","last_seen":"2025-12-29T13:58:58.057106Z","times_seen":287,"resource_available":false,"data":null}},"time_used":1468,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":291,"receive":1177,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_bbac9ff6-d09b-48f7-9e60-77639d6ba1ec.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:12 GMT\r\nContent-Type: image/png\r\nContent-Length: 92069\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s%2FAdxb7qgre7gWKMBmrSUQYX5k%2BQp7BSi2os3leg2ScPLrEs7%2FwLoPd6wbBhFaHTy6SYRFkiYlvSwlc1h%2FjY7asAIJpCedxrsB8OKOliDf0KMgErFUjmdsLjVegO\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"feb140fe19a10fd9e5db065a8a038f98\"\r\nLast-Modified: Tue, 02 Dec 2025 14:07:41 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48469\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047aa38a170397-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170392=LGK72/r9wLEJIr9d+AZ253CWHvbX8ozr9tp9MDldB5G8aPH3awDeFS2j9tUgnWT+6m8qQ6UEfWf72tWsi8ak8uWnSOrnl/zGOdYBljadFyiyDyDS5reeAt3jdpQhVvcane2SD+TGN1ytARChdlRlW1H4WIgzsqNovNrLQsAbv8/tMjhI6GXKOl4yva4aoW7C\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: C55391A1-B9E5-46A0-B257-E40DA5D62EF9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92069,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"feb140fe19a10fd9e5db065a8a038f98","sha1":"5d0134793913e11a60a320c144c99ed060e1fd96","sha256":"20a24fe332b621908f702caccd9af7c3bd5f2bb30e3688dbee74cf2e92d42da0","sha512":"52cb6adf379c2cdc5acc60267ec402948eeb494f7181d0cba92c8fe24a245dfb941834f5c3e3c05e97f6b4fa867ab9e2deca29651e25a0a224f8867f8855df6a","ssdeep":"1536:kaaOm3ctZpCgpl/Vhbyyx0ZxUfhUg0Zif6rBF8ikHy+bgM8yd41nt12S1M0tdQr9:kRMnogH/VR9ZR0ZimkHn+hxtd8i4","tlshash":"6e9302bb4743ce6ce52cf0bf0469124571f91744332b6baa70e978a4993f50fad318a9","first_seen":"2025-08-29T11:05:53.160781Z","last_seen":"2025-12-29T13:58:57.996683Z","times_seen":298,"resource_available":false,"data":null}},"time_used":4300,"timings":{"blocked":3977,"dns":0,"connect":0,"send":0,"wait":319,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_d4d2b521-861c-48d3-89a5-438931453851.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_d4d2b521-861c-48d3-89a5-438931453851.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 477126\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AtvdQhgC44gFzZlcTYg08C2v7WE53bQBD5qaS8fzrbsLcff1nKNPWdiJ0tTqs7dNa4MjPD30fGeBgCKFiUpboGQTLqywZGZMMypF%2FqVGptkw0FeSQOco67wKPW3V\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"7794a1e83dd1cb6d323415eb8a3dadd0\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:11 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48465\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047ad27c8d858e-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 1CB54C70-BDA9-456D-811A-143D684D92FA\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":477126,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"7794a1e83dd1cb6d323415eb8a3dadd0","sha1":"c692abae4e09255d43bbf4fe9839df3a0b42248c","sha256":"42a87f6dcadfb0ca9d2251974f0c53bd4d90d806c617737c734ed7655a5c7b9a","sha512":"9bf6e3bf06ae91cf7c57bef19f899b267203f646225e73debddb6b773b95a615ce83128b27e57e4c5cb0865ec120c5cadccaef29e544ade6c7e1819ce6626543","ssdeep":"6144:XnRMmtMWjUHq6Q/dpcBs6nyBO2BXI109eFefYmD2KJrMeQOKA5XdtJQpysRmcCjQ:3RMenUF6dpVRPD2SL1XdtapocCuz7TTz","tlshash":"c8a4231db113b3e608eefcfcf6a145d0dab34a53c8076a4fcf1b51092616b5f429a85a","first_seen":"2025-08-05T06:40:24.16226Z","last_seen":"2025-12-29T13:58:58.060042Z","times_seen":290,"resource_available":false,"data":null}},"time_used":8284,"timings":{"blocked":7122,"dns":0,"connect":0,"send":0,"wait":290,"receive":872,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.644Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size704x442_7f760e34-ebbd-4cfc-bc28-666cc8a6234f.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 242762\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hypJuvoIPgeDvmW2mXoZcIwZap5iCqR6yzNzfuLUUTEEqy2xi8u1VAF%2BKXja2DJxKMBiG%2FWCvdrC%2B46y0JL%2FN9waotur1Dzf%2BI6AnC7Na6aqJzhLEilMwLPrOQ%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"8d6414b9a03ebecda6026e71db5c722b\"\r\nLast-Modified: Sat, 06 Dec 2025 06:30:20 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48465\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047aa8cc9cb441-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 8D96A4DA-C6DC-4645-BC9E-7670F22D6E64\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":242762,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 704 x 442, 8-bit/color RGBA, non-interlaced","md5":"8d6414b9a03ebecda6026e71db5c722b","sha1":"3afa8517807eaa556541da8bfa2a85cd64543e25","sha256":"f8c741596d8b7a6849030ab73cf98cca0b3aa37fc8696845b2ac8e31d52ffb21","sha512":"0375d4b767373b491dc0030a0ce6390e2a772c58bbfb55d54d75e6efb45287b5929b2bdbbae6a5f2eb889136f09ba6cb5441eb9e340d3cf811b90ede739fb84f","ssdeep":"6144:EDtODfBnbPbUu8ZWsJnBVoLx/hO8RakAdAZDdO0:EhOLBnbR89JnBiyLd0O0","tlshash":"1b3412bd2c1f1b8375ff5dd94ec555ebbb2431abc8a94280a556892e70701e3b837283","first_seen":"2025-08-29T11:05:53.168348Z","last_seen":"2025-12-29T13:58:58.073143Z","times_seen":290,"resource_available":false,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":291,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/45540.1756903329400.c33043f4.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/45540.1756903329400.c33043f4.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:03 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-37fe8\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170383=1W/hvTJ7VLMXLjYqCI/hcH7YzzLc/epwkUArNXRBzTTUcsKCEEwzjCIAux4YKouZCg57Mb4bi2tNcqSv1JFtoEoK8R5tyQygGXQd50o8fJ51dSmXkpHV0OROYwO3/vs09Zz8pswZ3/eO2l0iAwqvTQ/gYGVcFuqJDQZWJoysdiISwe3A+ihlPsYDp9nkxYX5\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: C6FED793-5EF0-4DB5-813B-E32E17AAC816\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":229352,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"000be9e193b9b0e7a8e7e2fc6a908605","sha1":"1f04ee0d0816dcb4a310f1bf9053f36c15561922","sha256":"0968ff07195a9aad5c3f080a919c803c162ccb3bb176330b762c1e4e884e75d0","sha512":"d05ca2e4dbd262beab20be9f7872c1faf4d88129b59234fb2009c9ecc7114341558d7813d701cc5aa54dfa4ec028ab007eeff864ac6bed87a4ed8d42499954cf","ssdeep":"6144:rYD4wFsYiSGfKnCKPP6Xm9sm3MCln1OSgpozfEe5a:rYD4wFsYiSAKNH3TY5","tlshash":"2b24e894f294f1be075fc1f1d23b501af35b5e6120cc9ca0d296e6942e20b49da77eac","first_seen":"2025-09-04T00:49:32.837166Z","last_seen":"2025-12-29T13:58:58.015173Z","times_seen":439,"resource_available":true,"data":null}},"time_used":2036,"timings":{"blocked":1521,"dns":0,"connect":0,"send":0,"wait":480,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/sponsor/sponsor.json?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.891Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor.json?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: application/json\r\nContent-Length: 646\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nETag: \"68b00b6f-286\"\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nAccept-Ranges: bytes\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 4D621990-6BFE-4E08-9873-1F7DDD152950\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":646,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"10d2161de8cf99c474812f4c43645a26","sha1":"71884ef7281cdcb5084088f16d4550ce8790e634","sha256":"bb02fd7438bb49dd4decb6f76a71f11e93355332fd9f965d6f9f13bb8175aeca","sha512":"bf0fd1232309fcc5582d5c42644e1c7b4b8d235b1066e988ff55e0dd94a956f89742401f00c2d904359041c8e0c2bac8e9316252fab60db5eb0a3b4c935172f0","ssdeep":"","tlshash":"d8f0f44ad8b25b93211fb57c58cd050470294a8f0eccaac4baac987c4f598ddd1e839e","first_seen":"2023-06-16T04:51:50Z","last_seen":"2026-08-10T17:58:48.246933Z","times_seen":2852,"resource_available":false,"data":null}},"time_used":433,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":433,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/appdown.6e7c9177.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.997Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/appdown.6e7c9177.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/index-399e2569.1756903329400.f2d3fd45.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 10111\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-277f\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170389=idzLU/VnowglBgoqJE8E87wM7N2x/XjzHcgPl1shS4I1xcQPPmlzEkFuT2xu+AD7F4ZtTRdDfIH9Us1jlpRGvwS2rGSsoDgxnfRyd3GWrGiywCS9NNen0IIc+8Y2KMwSzT/mRYytP7KLkipz1SkQ2QNVsFqqQ7BWDLeOVIU+W/pttwEmcpHTO5VhtAMg9t42\r\nAge: 51798\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 008E9984-0DE1-4B40-A534-B67957AB2D46\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10111,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced","md5":"716d097b193628397635cfac41b561fa","sha1":"545d1876219bed15fe850a499a08322de6a26866","sha256":"50276d87fae9c1e30a32c32b4e90dcc2e227cabb4e3bb1d60ecb22fb50c5f2ff","sha512":"47ea5928e921bec4ce4d9c807ee921f6115a6dd27af6fa7325e6d988058d22cf36c03693ebc56665203809cfd6d008cd410380e688e90b36d7eeec18ce6aa92f","ssdeep":"192:cALsiDRih/bWKl4Hq2BHZE6+3paMeCsuTvB6hi6tswYmd:lBEv2Hq2BHS1ZaMJtB+tsud","tlshash":"4622d047a584327b826ec79c8fe98c112470ad1ce6f04d5ac44e711128e8df3503baf2","first_seen":"2023-07-01T07:21:14Z","last_seen":"2026-08-10T17:58:48.372171Z","times_seen":2565,"resource_available":false,"data":null}},"time_used":3561,"timings":{"blocked":3255,"dns":0,"connect":0,"send":0,"wait":303,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/575b716849f74d21b33f15ea7715e4a9?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.586Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/575b716849f74d21b33f15ea7715e4a9?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 24744\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15786\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"575b716849f74d21b33f15ea7715e4a9\"; filename*=utf-8''575b716849f74d21b33f15ea7715e4a9\r\ncontent-md5: A2RenB1/0sSHBWIvUv2QHg==\r\ncontent-transfer-encoding: binary\r\netag: \"Fh0TjgshOo8Sd9qa1VwIBgPRVYR9\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:23 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: RX187N2cg\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: a5UAAAArGzhBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24744,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"03645e9c1d7fd2c48705622f52fd901e","sha1":"1d138e0b213a8f1277da9ad55c080603d155847d","sha256":"195c4d72a74112fb5d177b446d9ee5c2c44e3b493de7148b90b6502ca514e388","sha512":"781857e61014809099d06ac3e041bfa73594e58d2d1049f9f71772642b8148939828d16cf50daccb95b10ea51e3ba04a115b10fcf938eb37d47bd14d03aebf2d","ssdeep":"384:MLyprMpcfE7dYA8pUfYdJ1ejSXi9XHTYgJjudCnpPV0kUwhMb548CN/Ylx:MLUrVeYEfiJgdHTYWKdSPVKb5vlx","tlshash":"9db2e1ec7eeae016c7361f0a4ea6fe242148ac3725cf2255326bfd9145c5498d1fc8ad","first_seen":"2024-12-13T17:33:29.060096Z","last_seen":"2026-08-08T13:35:45.187456Z","times_seen":193,"resource_available":false,"data":null}},"time_used":2854,"timings":{"blocked":1209,"dns":0,"connect":0,"send":0,"wait":1281,"receive":364,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/EGAME.d289cd48.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.812Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/EGAME.d289cd48.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 59546\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-e89a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170389=idzLU/VnowglBgoqJE8E87wM7N2x/XjzHcgPl1shS4I1xcQPPmlzEkFuT2xu+AD7F4ZtTRdDfIH9Us1jlpRGvwS2rGSsoDgxnfRyd3GWrGiywCS9NNen0IIc+8Y2KMwSzT/mRYytP7KLkipz1SkQ2QNVsFqqQ7BWDLeOVIU+W/pttwEmcpHTO5VhtAMg9t42\r\nAge: 51781\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 5B3DA792-6B99-4117-8AEC-2C9EE41FFC70\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59546,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"eb8991eb9e0db175522c914343f0a10a","sha1":"ce2d41b154df64421d46bceaeb9878da455592dd","sha256":"b837b4e9fc693e5c65eb049c56547caefe1cf73ea31ae59f95ae46d052fd36b2","sha512":"7d2a886e3ac412f6ea1b1ba290064373e1d07a0751bdd7f546af3116ad057d1f17bbe4847179cdf87297a967c0290280ec0c51ab9bfdeb1da0b881e366eb19a8","ssdeep":"1536:hvA9R/SReJczzaRBd6s3DhCDnQcvyFVWGDnmhKYNa67:hIPVczevUIhCDnQc21C7Na67","tlshash":"dd430276882a8fcd499304944bf9afe164eaf19097b3cf91f24c5fe0423d184d881b6b","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.515029Z","times_seen":2344,"resource_available":false,"data":null}},"time_used":1441,"timings":{"blocked":1138,"dns":0,"connect":0,"send":0,"wait":300,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/noData/cms_noimg.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.382Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/noData/cms_noimg.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 9882\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-269a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nAge: 51787\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 531E4A18-548C-4D55-B816-6175CD6A1428\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9882,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 700, 8-bit/color RGBA, non-interlaced","md5":"85e60fd8767b18839ffb552a5d543f8a","sha1":"341cfd68a5b39cb246af6ade1e3171c857d2df5a","sha256":"4b7ad68306ffac25830d1016ba86154890deef8bd77a03257b767b37de1c8338","sha512":"785f028aab80d3f96794431f84025483f490d7d642022404a7b14ccb4785aa52fe4a21048d44acda3bd160eedeaccfb4959a677986dfe47ef038d80724f2acb2","ssdeep":"96:74iGykVWI7TGvGJUgTFSebsBzYofEC16+TqBK7R7LWKaR8a8D7uZNgAMXFL73:74iyHunEFSebsvP1nTP7IF2uAAMX5","tlshash":"141259118573d43cd82ce57926df6fb93b709f996890476e8328e7342f2a2f78d60848","first_seen":"2023-05-01T09:33:58Z","last_seen":"2026-08-10T17:58:48.364752Z","times_seen":3146,"resource_available":false,"data":null}},"time_used":320,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/9e2693e96850412db6dca245fb093f59?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/9e2693e96850412db6dca245fb093f59?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 111393\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13982\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"9e2693e96850412db6dca245fb093f59\"; filename*=utf-8''9e2693e96850412db6dca245fb093f59\r\ncontent-md5: YPHHeIvjFIo3Db9Z+RSr/g==\r\ncontent-transfer-encoding: binary\r\netag: \"FkzGoPe49FMiCNOSpG32h6wN42vB\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:46 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: xeaNRSi0L\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: G8EAAAAqmQ7lpYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":111393,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"60f1c7788be3148a370dbf59f914abfe","sha1":"4cc6a0f7b8f4532208d392a46df687ac0de36bc1","sha256":"4126bd04b0380459e079462b3e0fb5a0654b5fb6c7c259fa9a9244b7d317e6ab","sha512":"ef4df4afc26a68365c30da321b39daedf9ac3d30e6ccabcff1ba08158b26a4f84de64c627e3fda7a7132e1385bda4630124e5c4e647ac3804c2ff620bbf49d59","ssdeep":"3072:bgiOsXv2nWFW3+IbUHabVr6cAcnDYijDni4ZFCnqmoZui:Ter+krAo88ziS8qma","tlshash":"99b3025da51980d3a680a7a7fc244ea65463d3d7a386cc450e3aece03f3b97ce375294","first_seen":"2024-12-26T20:26:09.863194Z","last_seen":"2026-06-05T22:09:33.515007Z","times_seen":279,"resource_available":false,"data":null}},"time_used":3332,"timings":{"blocked":1194,"dns":0,"connect":0,"send":0,"wait":1293,"receive":845,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size328x442_fc0e1468-bc71-4d42-9849-b6735b50978a.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 115787\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yLYpL6kJNJUaTAPw2SLw3ELfF37vEpUizDysIdqH15VE7f1uV%2BwsqmTLnsQ6vfDCWsCgkBMPIfpRnA4OrGrhhGSti8%2FLIjHNBzz2Y2vazX9A68n8ZqBCqkz2kw%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"abd281a4af5a65d4299fe253a6e4ff61\"\r\nLast-Modified: Tue, 02 Dec 2025 14:12:12 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48478\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a7e2ad4dd99-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 0D065367-B31C-4BAD-AA1D-CEBBFCE9FC66\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":115787,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 328 x 442, 8-bit/color RGBA, non-interlaced","md5":"abd281a4af5a65d4299fe253a6e4ff61","sha1":"fe83384c6f30f0d8088265253b05e664caa94b06","sha256":"e24c3350cac84789d5b9b5de7aabfe3203feb5f681d7cb27fbd637743754df57","sha512":"1ca10fd3aa8a6d8e4a2c1a47d701b1c59b7aa433aece4f6652ea0d24ba96c3d4a52078be3f26181283703f4e4f18e63fc9768d292fba09d96b9e8ca3ec5ebfb2","ssdeep":"3072:AaljLBKFeIcCPcF7fAV+e05d565c8T8mcArg5f:AsnBK7PcRAV+e07SRT8O4","tlshash":"abb312b5d477e069d8289f498b430092f5bea1a234ea0c726cc552f3165bdbe1ccca5f","first_seen":"2025-08-29T11:05:53.198537Z","last_seen":"2025-12-29T08:12:31.363529Z","times_seen":297,"resource_available":false,"data":null}},"time_used":6942,"timings":{"blocked":6647,"dns":0,"connect":0,"send":0,"wait":289,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/download/download_nav.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:09.879Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/download/download_nav.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 180314\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-2c05a\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nAge: 51789\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 0BCB7F4A-E307-4D3F-B27F-8A90B877F1AF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":180314,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 820 x 600, 8-bit colormap, non-interlaced","md5":"87eaffe415a7eb41b7b4b8a868bb3b32","sha1":"575618003efbf8dc8ea781379aeff463cd0cc498","sha256":"4264138e0c015e52e3efa14e34ce9c52490316935b4667756ea631b96eca64dd","sha512":"2b06fbacffed6de2fb1d4a6db2cbd0d9c5c790f9b5a10a6dceac64ff69d300f20628c465a720102da9bd857c80be886ab0a37848929741d2bdef6eddbe0de8bf","ssdeep":"3072:iWlCRQlVF5aSW/mUdJSu3405ovKFzkRKcZjF9Km/mKg/hPFsQBhXRU0K:iWM2I405oCRncZHL/mKWBhXRU0K","tlshash":"0f0412cc23773ffbf8a0865a83fbc1599c3bfd0824e56722ea1662b5186053145a59cb","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.552654Z","times_seen":2034,"resource_available":false,"data":null}},"time_used":618,"timings":{"blocked":3,"dns":0,"connect":0,"send":0,"wait":309,"receive":306,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/13575.1756903329400.cda1d494.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/13575.1756903329400.cda1d494.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:03 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-2f96c\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170383=1W/hvTJ7VLMXLjYqCI/hcH7YzzLc/epwkUArNXRBzTTUcsKCEEwzjCIAux4YKouZCg57Mb4bi2tNcqSv1JFtoEoK8R5tyQygGXQd50o8fJ51dSmXkpHV0OROYwO3/vs09Zz8pswZ3/eO2l0iAwqvTQ/gYGVcFuqJDQZWJoysdiISwe3A+ihlPsYDp9nkxYX5\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: FBE6A517-97CB-4E9D-A14D-0B42894BE1B9\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":194924,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65535), with no line terminators","md5":"60a85822cef01147878bbad7876a1fe8","sha1":"94563a78fcb76c76cce769d2fc4021baf782c844","sha256":"5b0a33a268e1507f5e758833c854e3cda700d19c35357e4a2098263a80da8892","sha512":"c23f2184349d611d1c54c379a0aa29d9564ea4b76b44c049647f0caf9e5b9dfd809c87eb9fa94c58377df9a9540580d0920802784fe9f485380985f36eaa4a5b","ssdeep":"3072:z7jHoKRKphCnDgJoec+IDWIzls+7Xr0X7:sKRBgUPDWCW7","tlshash":"42141a84764170b8c396a165322f601ae22f789650dd9c24f3789ba47f7470df26fabc","first_seen":"2025-09-04T00:49:32.754298Z","last_seen":"2025-12-29T13:58:57.972807Z","times_seen":438,"resource_available":true,"data":null}},"time_used":2072,"timings":{"blocked":1543,"dns":0,"connect":0,"send":0,"wait":495,"receive":34,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/2e000f8b3f134956bfda36c84ce8ae50?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.472Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/2e000f8b3f134956bfda36c84ce8ae50?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:08 GMT\r\ncontent-type: image/png\r\ncontent-length: 42867\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 2627\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"2e000f8b3f134956bfda36c84ce8ae50\"; filename*=utf-8''2e000f8b3f134956bfda36c84ce8ae50\r\ncontent-md5: xJb5c6xbQnFLbFP2KJ+Ddw==\r\ncontent-transfer-encoding: binary\r\netag: \"FiW0o3w3kPnUQMfjxGUUhB0pqlqc\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:41 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: Va9AMU1rP\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: iKYAAAACPbI4sIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42867,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"c496f973ac5b42714b6c53f6289f8377","sha1":"25b4a37c3790f9d440c7e3c46514841d29aa5a9c","sha256":"4e43d850a25819600c9a6a288f19e6737e7879d9ed1061793be79e62cfccee78","sha512":"e3739d580831a60a31f7cf432a73f795c6736ef8c251b70ee1fe2f5d1a9661737921d62912d93a93c1dafc9133e717b56e9a3aeb21acb998032e8ea9aa25f18e","ssdeep":"768:gNm755hQyyCAk+/+iT+M3DG6d2g2Kl70tPVARY0zhpQh+96UJ5azlyBCe:k255hQPBk+/OM5osIfGIh+96TUBN","tlshash":"811301fc9bf9fae4dcad0fef20221d112a9431b1d680b91f1264727529199d9eb011f7","first_seen":"2024-12-20T19:29:53.805178Z","last_seen":"2026-08-09T10:14:04.785258Z","times_seen":14,"resource_available":false,"data":null}},"time_used":2876,"timings":{"blocked":1321,"dns":0,"connect":0,"send":0,"wait":1088,"receive":467,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/chunk-svg.1756903329400.5bf5ebac.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.829Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/chunk-svg.1756903329400.5bf5ebac.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-708ca\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170382=fD3dUXvTAvqkKlHn3bIXCn0ldYgCieEWsInrTrUy2OYSNeSM3Ocx74L28Ir9Qu5IZZNTVdLIdSEvgdjLQMGdKY8rAwJgkpF4uDVhyWLRwemAIwfZs+oHw1mOuVEVgwYh/ydxqVefveJNFmABhM/gLFLt+3W80dYlTLRrtHmJoHD8gkh4JbcBxTMn6BGv6EQe\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 84701268-3C57-43AC-8B69-65C6D2AFA5DF\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":461002,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"7f3450cde65c4d0964dcc6d243a1656e","sha1":"ad5b362b491b71dff95398219d8e190c80650865","sha256":"924472178572d451953cbf73efcf577a697b3102176fc17d9ab8c379b6b37bee","sha512":"e8f2350a17821376b71a040626a3d5c58cf5744b22d512fbef45b3246558b0f7001ca4d48d32e34831ec7750e40008f7aef529b4e618c6770bb5e72e4c028cd2","ssdeep":"3072:38nz2uaLZSZvx6Q/sIPrekK+m36Ua94sRZI7gbpU:38nz2uasNxpXPrekK+m36UHsE4pU","tlshash":"7aa4fcb4c190f4edf704ce196e7c9e1c50321688e0a9e9e52da9fe0d9e85d6b241cdec","first_seen":"2025-09-04T00:49:32.781171Z","last_seen":"2025-12-29T13:58:58.073596Z","times_seen":441,"resource_available":true,"data":null}},"time_used":1547,"timings":{"blocked":427,"dns":0,"connect":0,"send":0,"wait":817,"receive":303,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/45734.1756903329400.46beea1c.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.836Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/45734.1756903329400.46beea1c.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:03 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-43a22\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170383=1W/hvTJ7VLMXLjYqCI/hcH7YzzLc/epwkUArNXRBzTTUcsKCEEwzjCIAux4YKouZCg57Mb4bi2tNcqSv1JFtoEoK8R5tyQygGXQd50o8fJ51dSmXkpHV0OROYwO3/vs09Zz8pswZ3/eO2l0iAwqvTQ/gYGVcFuqJDQZWJoysdiISwe3A+ihlPsYDp9nkxYX5\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 0DA2D2D7-0608-4530-BACB-606BE7BED3BF\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":277026,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"e5f34b5441b6b582d6d469c537f6f97a","sha1":"defd5aad4e0d066131c97173b21b7b3442cdb951","sha256":"44db08eec9e6d649f62d7d208bce223e33424ebc58c21098181a90ae5a1c6437","sha512":"4096ae8bc07709597c8411157950bea75aba46cee36964fe1e280a31a2c2c9d4a8d5821c3e8a4cca552919511930bc9f834e2054580c452acc17c1011d1e6168","ssdeep":"6144:F/EFTU8Ra90Jjytg7DiQPkcsz1h84faSDWidmVHrqZL:9y/jytgPJP484fa5VHryL","tlshash":"2a441c84b291f0b4879b42f7922b4055a17f48a130ccacb4e2a5ed90be7555c927fbfc","first_seen":"2025-09-04T00:49:32.926111Z","last_seen":"2025-12-29T13:58:58.062377Z","times_seen":438,"resource_available":true,"data":null}},"time_used":2410,"timings":{"blocked":1634,"dns":0,"connect":0,"send":0,"wait":484,"receive":292,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/css/home.1756903329400.edf3cc73.css","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.111Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /css/home.1756903329400.edf3cc73.css HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:05 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-13930\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170385=wZL4fG/IgiVy5fExmMb/Ow0HDd89uzX2ljGOp/NtAhDUJCXdjoxMqpx40PbsYHRtZQcELJzO4Cp+i6Jug5CHfX6PodfeNhGUkRn/X/sabWolXc/0V20gYNvd0jXi6czAjYDEAXiTo6c7jbK5eVDYwKcKZwM61eCf/Q/LgkgdBoQjqSvcWMAHHLi1cdLBTwEK\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: D450870A-3CE8-4918-A2FD-0A16656BA6AB\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":80176,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"2e29065a1a5515643e2fd444bf8a6276","sha1":"fca2b112876cca0762e522356083c0b8649f0520","sha256":"f77a87b9e81ebb2473ae09a9dcbb13e383ca95151a71a6aa85bfa51d6223f6ed","sha512":"0549da8eb6c9e2dbe1f6ec23b197491230176fb5952835cbed1e0650f680db8333bd65e3b4b026804c94d48229b8c6974427978bf83c88cac162db9511ead377","ssdeep":"1536:yzOcRM7jufawS2d3a8WiLKbzGhbKpXdNCg9khb+TJ/:PtuSJwLUK0Eg9khb+N/","tlshash":"25732b7aa610253db437da72b9f05bd8b524c846d7634a3df2537a25cbc72e213323a4","first_seen":"2025-09-04T00:49:32.974291Z","last_seen":"2025-12-29T13:58:58.075129Z","times_seen":426,"resource_available":false,"data":null}},"time_used":488,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":487,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/855b004b35294f07b4876f293aa10d25?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/855b004b35294f07b4876f293aa10d25?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 69719\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 3289\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"855b004b35294f07b4876f293aa10d25\"; filename*=utf-8''855b004b35294f07b4876f293aa10d25\r\ncontent-md5: b5J+sEC91clyqTQ/2ci4cw==\r\ncontent-transfer-encoding: binary\r\netag: \"Fq0mLyR3vvJPfbh5JCKSvx2x1gn3\"\r\nlast-modified: Sat, 13 Dec 2025 19:02:38 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: nV5KK6QAa\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: s4oAAAA6W9Oer4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69719,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"6f927eb040bdd5c972a9343fd9c8b873","sha1":"ad262f2477bef24f7db879242292bf1db1d609f7","sha256":"2025b1be0b406cee507d54020cb29df1737ae6f37a09ea637c9fd212a31107de","sha512":"640a1ae2a4e938ea0dc2e6769022605721e680bfe11a7faaa9c8be5958ed688ae32c30200e673bfce9e0ddcbefc33d4d21a4438ef5596bdf2a62810d88171c2a","ssdeep":"1536:aq1w3sXYWsH36x3WNIohXUvftQkC5yabUw3R0E:oWYdqx+XUekC3b53yE","tlshash":"4b6302d065d9dd2a93a9d9e8873192ffbb3b03d0ce264f51a0934ec01a7e6c1d83949d","first_seen":"2024-08-19T15:01:26.115292Z","last_seen":"2026-08-10T17:58:48.523141Z","times_seen":92,"resource_available":false,"data":null}},"time_used":3181,"timings":{"blocked":1311,"dns":0,"connect":0,"send":0,"wait":1088,"receive":782,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202505/_raw3_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202505/_raw3_size656x844_f676ec47-4b6f-4d37-b476-fd69f2381a1a.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 268659\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OcQbQ4KcPP6AJZGu3lc9XnNP6rBt8xuo5TOmS97EmX5XWnE2AQUCUn3xUmZTdSLbl1bAyB2KfTkt7wa10ZEgj3o%2FPqK1shOU3iagcmfPA9T1Ff9dqosA%2FfqfF0Eh\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"f59451347b49ac6da9ca8dbbd242a85a\"\r\nLast-Modified: Fri, 24 Oct 2025 10:14:36 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48457\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047b0568dc08dd-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 97E82AC4-F0DD-4828-B3E3-21E99B8D65CA\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":268659,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 656 x 844, 8-bit/color RGBA, non-interlaced","md5":"f59451347b49ac6da9ca8dbbd242a85a","sha1":"1f739642381465a5c70a39f62be8dd9c8301a5ee","sha256":"04baef1ce689cbbeb934452a4fc47d78fc8c76abfad8794d9dd46210b607dea3","sha512":"22a9b48743e148281698602b6698551b4e00f8682fb8284977b622c00d00881d68f9677171d88cf72d67cf4a58865c0da893a4c72f0b38dfcc2841fb990a7000","ssdeep":"6144:sdhh8kdFouFNkfPmAz4/jGkhyyIgc34SMW:KD8sSuFNk2Az4bGkh3c34vW","tlshash":"fc4423a923587745d7c322bcd0d86d32b94a74c63ae28fdd109613f602f9d89aa43f47","first_seen":"2025-08-29T11:05:53.115888Z","last_seen":"2025-12-29T08:12:31.313621Z","times_seen":286,"resource_available":false,"data":null}},"time_used":7020,"timings":{"blocked":6713,"dns":0,"connect":0,"send":0,"wait":292,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/css/chunk-common.1756903329400.fcaa3bb6.css","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.824Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /css/chunk-common.1756903329400.fcaa3bb6.css HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:04 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-340e\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170384=UXdgwTadCNGnycLW4Zj5I9uCe+sKxgsmiX8KxJnX/l7K6YcQVeX1HiLd/rCstBD5HLpnkenZga6azTJP1cU5nZmlxt9PR0QGMiNerYL7dN5sz61ocfilE3++ukyV1lhJw+0u6na49gu9BS7923+W6EtpFMQuPzUrtxOS2JSxMij9cMe193orUuIYY0/89ij1\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 95E6F498-44BB-4FF9-B217-8AC6065AC899\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13326,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (13326), with no line terminators","md5":"826c687e5a03ee71f95d5348db199e55","sha1":"46d95f05e1da96866b57353cd147ecfe9f20f2dc","sha256":"daf2bc8bfaa2d7608bfcd21eb0a6aeda1d3452dc26f2b8577a7c69e599bb8d3e","sha512":"47a2d7bf1b9905ec12876df1008c5b7cd9da2ef5d6f72026fea2ef705e6b63bf2f88941c5b57b112aa663a612327e48e1e85da444a119e7187b615b4089da7df","ssdeep":"192:4dQK/X4cBY4mZGX1lsUTLA7gY3bz/i//LN4hHSQZA2VxM2XwKjv0:M8oTG3bz/i//LihHBrxP0","tlshash":"7852b831d635b53ce57be226f9d09adc6024d417e2730baeea653b3ac5ca4d215332c8","first_seen":"2025-08-29T11:05:53.265444Z","last_seen":"2026-04-27T23:33:28.249766Z","times_seen":1343,"resource_available":false,"data":null}},"time_used":5321,"timings":{"blocked":2367,"dns":1,"connect":290,"send":0,"wait":576,"receive":0,"ssl":2085},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/sponsor/sponsor_nav_web_3.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_nav_web_3.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:10 GMT\r\nContent-Type: image/png\r\nContent-Length: 7412\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-1cf4\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170390=WLa6nzBR097ftBNI8c6xMTQRogcqlqMxfM6kcYmA9KL5X5htbCZsk1KckStRocc6vpdPSoQdWiHIetTZLjTpGEICaFxucCCAAlj98Dc66xHKY/l5b8mBzbnVvYtWRHIA1IBvpH1nrl8eRmEXNt3uCyGZoSGGzxbp8IMeVtse7YvN8ItyACsCrLKUcduYv1YH\r\nAge: 51799\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: DB693674-A07B-426D-8D03-0B141510771F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7412,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 206 x 332, 8-bit colormap, non-interlaced","md5":"eb94a297c215863d5d2232eaa67f4779","sha1":"d006f382f63ada4e4ef65d124a75eac2e4e72dd0","sha256":"6bd46b617bf27cb28fb798d50b2d6daa2aaed1a278ed50e9aa549b6e4fac48c3","sha512":"dc7759393acb5e7d1a635b4d91d73e84abc41fe6afde99a85a8e4ed6f4f8b1b5819bbcaa80b1c213c00c89df8b81db512a7bff142b24c50565ff1e6289f1a30c","ssdeep":"192:Sfq39wgHGYB1fcUWobKUUR6IHaDmzDxfbTow:uQ9gCEUWoWUe6DeJQw","tlshash":"94e1ad76a7f6d695a6b7908cfece94050fbba2722c6352762b7b8c02170c339525b411","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.505323Z","times_seen":2233,"resource_available":false,"data":null}},"time_used":4518,"timings":{"blocked":4221,"dns":0,"connect":0,"send":0,"wait":297,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.723Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /ecb/8f8306425fb46e096ba9db3ab31b67b681fbb31575ff397b0117 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://f214n.xyz\r\nXign: XmucwwTxYKCwxAL3EPuRZHD4ba01VKihJxFK9g7tX84ONwOctg33Rpa3z7SyLJqmxfH1t6wZqYyV1WwWqUdd6hFiALAZa8S9YFfqRC4nOd4TW2/jS4AVey//GKXR4Ypkn1TYX8lva0PHiuaKk41O6cfn9C4+PQhtOKUEX50NduU=\r\ntimestamp: 1766170386704\r\nsign: 506a5c115f4u7h2l\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Fri, 19 Dec 2025 19:03:07 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 60C5D226-46B3-49AF-9595-32DF9C0FAAF3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2132,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"6947e9f63ece2cfba05385ffbd545058","sha1":"2336911646ac736bfbe3072fe0fb8ccef87a50f9","sha256":"6c01d86f21b1b3d72260157612be83881c43d80c457e9d5228f395b1878440eb","sha512":"4cefc1859bd32d799e63b4292d0a1dc096b29aadca25c45c128ff3da1dec46d75fb7b35b0a1a0fe3f037edc6ed7023e366f6245ad65003c53f8fdefaa853ddac","ssdeep":"","tlshash":"9a613c2b318bd300fa3a0df5c1635a89595cc21dea6fe4a2c6a44e32599330670bd881","first_seen":"2025-12-19T18:54:13.860558Z","last_seen":"2025-12-19T18:54:13.860558Z","times_seen":1,"resource_available":false,"data":null}},"time_used":530,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":530,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/4761192cf6b74b6ea533a33bd0590efc?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/4761192cf6b74b6ea533a33bd0590efc?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 48954\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13082\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"4761192cf6b74b6ea533a33bd0590efc\"; filename*=utf-8''4761192cf6b74b6ea533a33bd0590efc\r\ncontent-md5: E+IDi9I6OM4yo+slnIv32A==\r\ncontent-transfer-encoding: binary\r\netag: \"FlTLEWNNt6wHuapzaLUb165bDySA\"\r\nlast-modified: Sat, 13 Dec 2025 19:13:08 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: gSsyY0UES\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: KIMAAADtcbK2poIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48954,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"13e2038bd23a38ce32a3eb259c8bf7d8","sha1":"54cb11634db7ac07b9aa7368b51bd7ae5b0f2480","sha256":"770fea15356ee9da50fc65d66e846e804468d51af8ae5036700e062f2f4bcace","sha512":"3c16f14c9e1f822fa912de6405ee25276c0e0e679667597ec4f1bd7b241586aa6f9f51127c0310043cd81619b385a9ddb9e4b99ead37426d6d1afef0e29660bc","ssdeep":"768:sX5XBU1RaaekSb0TOnkvQFWOcYEqia9W8wLEY8VZUQZ+ZxtsxmSXcLeyriykW:uXBLae//kgZjia9KLb8VZUQo3tsxmSXA","tlshash":"7b23018237bcced6af402723146e0d008b77aa246cb5adb971695d7b043464f2674eb3","first_seen":"2025-06-01T16:50:02.020072Z","last_seen":"2026-05-17T16:34:28.568199Z","times_seen":222,"resource_available":false,"data":null}},"time_used":3226,"timings":{"blocked":1183,"dns":0,"connect":0,"send":0,"wait":1295,"receive":748,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/api/sport/match/list?sportId=1\u0026client=web","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:12.428Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /api/sport/match/list?sportId=1\u0026client=web HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nx-request-source: https://f214n.xyz\r\nXign: iCB9T9/aUsNHV+Bx1IxGFmz6sQihJVFUwNo1no/oqIHGjbfPw4DmY/pI4iFGYAIYt5jKAOqlhg8vm51eOSdzERrvZIKSt7YhvrO8oD8slgHpWC4E0dBooOiKYmXmONiOm8nqFtHSeRu+lP+gGab5bnLkTmrB1FDEsX8nQxULRlg=\r\ntimestamp: 1766170392412\r\nsign: 5i4q03l5f3021h3d\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:12 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nCache-Control: no-cache, no-store, max-age=0\r\ncontent-encoding: gzip\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170392=LGK72/r9wLEJIr9d+AZ253CWHvbX8ozr9tp9MDldB5G8aPH3awDeFS2j9tUgnWT+6m8qQ6UEfWf72tWsi8ak8uWnSOrnl/zGOdYBljadFyiyDyDS5reeAt3jdpQhVvcane2SD+TGN1ytARChdlRlW1H4WIgzsqNovNrLQsAbv8/tMjhI6GXKOl4yva4aoW7C\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: E6E27352-9E7A-4378-B41B-03FC4CFA5B2F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19503,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (18747), with no line terminators","md5":"b62744b20485b67a816cfd3678aea26e","sha1":"8b28cbef01aa52358a8a6a44395aa555206bf292","sha256":"055b550ec276f079d01db527a3a24a765885b60c9321d25e21530f509e279d2e","sha512":"f8d7ae0465a47624007d60e3527c504f321026b47e5f14b739b72d26536a9370167b795e3c9fed2b0c41b3203d1de651d9795b525c8a1160983b6c4f6f0c3479","ssdeep":"384:eAPcP0oMzn0CdJ0ZcA0EMTl11urebmA5Hmy4AHz4lfz5SV9oHQffs8kb8/v8831z:eAPcP0oMzn0CdJ0ZcA0EMTl11urebmAl","tlshash":"3d92f05681ed18a52f5c60d25c0e7b4c987eea1b0aaef9d5ed4ece4c30b43fb9204d25","first_seen":"2025-12-19T18:54:13.73044Z","last_seen":"2025-12-19T18:54:13.73044Z","times_seen":1,"resource_available":false,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":460,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/js/64369.1756903329400.27cb8135.js","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.837Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /js/64369.1756903329400.27cb8135.js HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-269de\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170384=UXdgwTadCNGnycLW4Zj5I9uCe+sKxgsmiX8KxJnX/l7K6YcQVeX1HiLd/rCstBD5HLpnkenZga6azTJP1cU5nZmlxt9PR0QGMiNerYL7dN5sz61ocfilE3++ukyV1lhJw+0u6na49gu9BS7923+W6EtpFMQuPzUrtxOS2JSxMij9cMe193orUuIYY0/89ij1\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: B7543636-3756-489B-BEF8-A28B98B42D84\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":158174,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"ce99014ab42559bc99f808a69bf596c2","sha1":"adf52a59aba8080dae7b97585e346f5aa782141f","sha256":"39076e64a0e5facd6f6f3d4db7f7fa71039c87d4a6250298dd4bd3059bfd9863","sha512":"ede23f1e36658737f40782ab61a166f1a2a6f61957524beefc283035c39337325c487d6236975bd97cf44aa91b31ed6985a3416ef561edd5b977ff02fb6b1b54","ssdeep":"3072:cHW7tB4Vgj5tNlxyU5YegxYffj7TEOiG1Zl+DJVkzEcx1nKR:cHW7tBwgttXxyUtffjAG1T+DJVkzEcxE","tlshash":"6cf31bd4f2c070f6475f45f2a22b1075b26f4d92318c98b0e15ba6597f21a48c7abeec","first_seen":"2025-09-04T00:49:32.946075Z","last_seen":"2025-12-29T13:58:58.086406Z","times_seen":434,"resource_available":true,"data":null}},"time_used":2489,"timings":{"blocked":1972,"dns":0,"connect":0,"send":0,"wait":482,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/f78b45ccf2e64bf68d2e202e4df6a404?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.567Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/f78b45ccf2e64bf68d2e202e4df6a404?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 90387\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 29268\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"f78b45ccf2e64bf68d2e202e4df6a404\"; filename*=utf-8''f78b45ccf2e64bf68d2e202e4df6a404\r\ncontent-md5: 2y9cgTFRGGJ8aNz12qOhXQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fo7PwoBWyhfdZuwlYjN3BVH4mguQ\"\r\nlast-modified: Sat, 13 Dec 2025 19:06:51 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: n0VkW4GBZ\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: zYsAAAB9mCH-l4IY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":90387,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 351, 8-bit/color RGBA, non-interlaced","md5":"db2f5c81315118627c68dcf5daa3a15d","sha1":"8ecfc28056ca17dd66ec256233770551f89a0b90","sha256":"b371f501ac6b0561406dd594e1d27bd35427c71d5e90f5ff436e5bf20e39a3c2","sha512":"543e98c3e227f9adbff89f1575f00888fc80bf10ba0518ac354da04c68222f7e1eec8ec027bb4d2e986c82eb7141210dee4d0bc61e442decb68c2d3fd7b7f50c","ssdeep":"1536:OOKcivX40GNZV2KjEdzzgJzlCdNP3yq7IqAEhyo41fY1i8xK9Rbfy9WjanBxK:/Kcivo0GN2KQdz0oPPCiAN71fY1i8I9d","tlshash":"4b931243a8dcedcc126f7b7ed40ffb98992549e0109eb76de815537cc2b6a2a5c216c0","first_seen":"2025-10-16T18:47:34.173057Z","last_seen":"2026-08-10T17:58:48.52888Z","times_seen":170,"resource_available":false,"data":null}},"time_used":3291,"timings":{"blocked":1228,"dns":0,"connect":0,"send":0,"wait":1286,"receive":777,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/gpmaster/_raw3_size704x442_73525908-fb7b-43df-ab6b-ee9a1274a74c.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:16 GMT\r\nContent-Type: image/png\r\nContent-Length: 223136\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rznM4c5J%2BjlLkzBfMbx3p6BvdQ6ucCPa9FpipTK67JN6KENUjpTOR6XtW6Dq5okygAATjJDYLeRy1LbIkRy0cqeDvFsXOFfIL5HjsGnw2mcwWw4iqX4MoAS1aQ%3D%3D\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"da3b1020a9a2b09010b291184754a369\"\r\nLast-Modified: Sun, 09 Nov 2025 14:20:26 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48476\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047a93ea68219a-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170396=4SkrsUSoW8B3phE2Wse/QgXyN9AZhS7w9ObfuAIkP6rYfORomPSS+kQV1rAbREOB4yWOtpH7eXlsvd6OOs8mKMhW5hce4rh9MEkd9H4Bh9H7w8kQNMGdjlTPEVj01bWPsAbErnbj0jGPhZof+HAx78rmv+yV3MEcz8kx7Gt3i8HP8JC3ceg3xhIKk/15cbGe\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 7E52AC79-B5D9-4F7F-AA72-0D8F16F22C82\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":223136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 704 x 442, 8-bit/color RGBA, non-interlaced","md5":"da3b1020a9a2b09010b291184754a369","sha1":"c2d83f8c56c6e87dece5c934a28ca227ae094d48","sha256":"14b50178eb3b3f008b02476fee254dfaacb43181b760be8d3a1c7e5ff5401dd4","sha512":"3eeae26ae8746f3dd69d1640b0a791149692ef83b86997d98f0152f98376e931637a574bd82110c7765be51f0184bc8e33c9d04659f510d51c47b1bcc7be2059","ssdeep":"3072:c7iZjMzh8mXTYQ/tDoXB0TX8jLwAqw6Gw/mS5xr4OMWf8SG4DcXtHRpf7JeOrrUS:miZjMzh8mX02lo28vwAqVGoxreZHfl","tlshash":"80242397c71e3ebfe8a25c53b962143e66328042ba0dd4f85cdd14b6b12b1f50ca8d5e","first_seen":"2025-08-29T11:05:53.247777Z","last_seen":"2025-12-29T13:58:58.050217Z","times_seen":297,"resource_available":false,"data":null}},"time_used":7523,"timings":{"blocked":7223,"dns":0,"connect":0,"send":0,"wait":289,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/bj3.a7dbd558.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/bj3.a7dbd558.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 5835\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-16cb\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nAge: 51795\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 8434A8CE-D61F-4277-A2F6-430AD57CF9C9\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5835,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1003 x 171, 8-bit/color RGBA, non-interlaced","md5":"b79234bcd23ce7e063481b3605bcdd45","sha1":"eace4c48cc352cfb10fb6fcffed50748f18aa78d","sha256":"2dbca2ee9a515b178cb6a5ce670a5dafa30941ad8c753fa3e94642f8dacca13d","sha512":"40fa685181391f1ca805440f53683045d1fbd5c0f36cf471f53641c6f289481f42fefc4d1f2b2fdfe8a20d7488ef0537f10352492e46af76770b49fe8876def7","ssdeep":"96:brOIaX7VK+RUSrZ3rnZ1L++y+hsVoK4CBVVikox3n0muoE7Nqh7zwGto:K7VK+RBZ3l1i+y+3peikr3oEJqh7MCo","tlshash":"91c18f03f313ed339b875f190abe4dc3498b2f9a4725a7d6285b5aa89654819c062e82","first_seen":"2025-08-29T11:05:53.328141Z","last_seen":"2026-08-10T17:58:48.467139Z","times_seen":2614,"resource_available":false,"data":null}},"time_used":2044,"timings":{"blocked":1742,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/bd678f689682425ebe7be1e1d64feca7?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.601Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/bd678f689682425ebe7be1e1d64feca7?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 7704\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 15785\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"bd678f689682425ebe7be1e1d64feca7\"; filename*=utf-8''bd678f689682425ebe7be1e1d64feca7\r\ncontent-md5: 20QRo8TOHQ8JL1udHfCGZA==\r\ncontent-transfer-encoding: binary\r\netag: \"FtwLtQ8WhlqHCymy5TGn31SgLnQ8\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:19 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: Ad2nt1mqW\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: pgIAAAAEG1JBpIIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7704,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit colormap, non-interlaced","md5":"db4411a3c4ce1d0f092f5b9d1df08664","sha1":"dc0bb50f16865a870b29b2e531a7df54a02e743c","sha256":"51fe7d5c69e9c282453539e7f20750494193fe746c628219323fb869d90320c1","sha512":"92ba82fd3f4da5aa41f93f82c723bf906c08e3df48c67011b1ba5d66da44a65c543a6ce9004df7dab2cd524d79c736b1647a8de13996c0757bb8890f2f8aac45","ssdeep":"192:3nnnXNsKziYI5ZzOj1EGMN0KA1RDsbVm8Wv/Mi1i:3nnWHjC1EGMuKIukt1i","tlshash":"94f1aeb0f17fd8849c3867259290be7036d40d497bb87ba632f4c8657278f207278da1","first_seen":"2025-01-06T03:23:13.877891Z","last_seen":"2026-05-15T23:42:44.612515Z","times_seen":183,"resource_available":false,"data":null}},"time_used":2926,"timings":{"blocked":1197,"dns":0,"connect":0,"send":0,"wait":1296,"receive":433,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202508/_raw3_size1298x1156_aa2a4724-288d-4252-82c6-453d0458d8c1.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:14 GMT\r\nContent-Type: image/png\r\nContent-Length: 117319\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6sJNajqitDxec8Qy%2F95czzz2J4gRCfYtY5QVR%2Bcofrzaz3Yqhon6gdceEfkkhq%2BUn3E6SDtA1rPsWnTS7XcQThXsV2J39SPnMsboVut1gG8%2FopuKBVHhK6dMzftV\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"e77591741af3e68e5fe71d23ae4370ff\"\r\nLast-Modified: Wed, 10 Dec 2025 11:51:59 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 51768\r\ncf-cache-status: HIT\r\nCF-RAY: 9b042a26adde04c4-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170394=Nz/+pSZmaO2C7uXGVyo7DBMkcXHGCcUuHmaPtLTQSXXLpvwIEjYbRDsDBkLOVqPuf9OO8cBm2gBYUxJ437Y8TlbdnSLR8QRLsz+VHrr7fKeAWVvF5ScDjC1Xk6Vq6nfHSdhffhfE9vkWD6cxZKtT1AJGoe4WIf8+VJGatPaoUEhG6OP8V/thIabrnWnKspXM\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 263AAE8F-F927-446A-8D11-6745E419987C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":117319,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1298 x 1156, 8-bit colormap, non-interlaced","md5":"e77591741af3e68e5fe71d23ae4370ff","sha1":"ac4d530b4ad25b0dc275d4a16d0a93c649aa5822","sha256":"b2c2bd6de89142477d0cc668277e5a8dc737a7b09e85a8ea98dd59e3879154e1","sha512":"20daacb87078c7f45478e325e17d9d824653899ff15e004f41a73dcabd668cc011617bfa0526b8e00020a79cd0928b6837531f0333bdf942afb74e923e6dc51a","ssdeep":"3072:A+kUtq3tYWiGRJMf+5rzUZpd3F/WKDT7PPrJdd1fExWh:AeqmjiJG+5iF/W0/nrJdfQq","tlshash":"5db31280331968a5c586b83636766d969cb5ec36b347060ff96cd0a814428cf6f9fce9","first_seen":"2025-08-29T11:05:53.117443Z","last_seen":"2025-12-29T13:58:58.08881Z","times_seen":295,"resource_available":false,"data":null}},"time_used":6061,"timings":{"blocked":5766,"dns":0,"connect":0,"send":0,"wait":289,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/7ba35fc1a1e34598ae5ad01bce85f78f?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.523Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/7ba35fc1a1e34598ae5ad01bce85f78f?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 46945\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 704\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"7ba35fc1a1e34598ae5ad01bce85f78f\"; filename*=utf-8''7ba35fc1a1e34598ae5ad01bce85f78f\r\ncontent-md5: 9EFZqSVDuQPdMMcw0LGqDg==\r\ncontent-transfer-encoding: binary\r\netag: \"FiADs4ZHR-6LY09Fwa6Cuv0N-wOk\"\r\nlast-modified: Tue, 16 Dec 2025 13:13:48 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: d14h3tCKA\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: koQAAAAo_p74sYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":46945,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"f44159a92543b903dd30c730d0b1aa0e","sha1":"2003b3864747ee8b634f45c1ae82bafd0dfb03a4","sha256":"cb9bb0108aeef8d252d9df1839bd18ad202d1c911d349617bf2309274043b4f0","sha512":"94fc14787ef85a93ae4c05ae116cd88145adeb165c447568109cde99f5da7257f3a3d25481eb53bbb5ef9718c8af94434f1a5a99647248a0f77682bb24443437","ssdeep":"768:7l7LN+rpt0j1OGJa71door96KDMguzYkZCtuAS33qlChYC6fbluBhHZku:B70rpa017Z4gu8kMuLqlCV48Bhn","tlshash":"b423f1449218b1fbc54acb8f3eaa540c4ab156fe01b6b17f9965e4a5e23c0c848bdde4","first_seen":"2025-01-29T13:39:14.803522Z","last_seen":"2026-07-22T15:07:39.583945Z","times_seen":300,"resource_available":false,"data":null}},"time_used":3030,"timings":{"blocked":1272,"dns":0,"connect":0,"send":0,"wait":1286,"receive":472,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/98375e4c5688473fab8c1d7c3b319370?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/98375e4c5688473fab8c1d7c3b319370?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 71734\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13982\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"98375e4c5688473fab8c1d7c3b319370\"; filename*=utf-8''98375e4c5688473fab8c1d7c3b319370\r\ncontent-md5: 1x69pcf7ypCTocKXjEb2GQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FgYB979set3WvxZcQBfCjVAdOsdh\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: jX7XR0Ach\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: O3oAAADG5w7lpYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71734,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 334, 8-bit/color RGBA, non-interlaced","md5":"d71ebda5c7fbca9093a1c2978c46f619","sha1":"0601f7bf6c7addd6bf165c4017c28d501d3ac761","sha256":"275903d219b77027db2b4a92ccc9a73334bf5f6134e42fb74c76ac7b061c90fb","sha512":"60d921036fc6dba1305f2f5ec54faf99f52df495d84c353203cd3757c73f2a83d76d9e11a8cebef89dcd3fd4387d0eddc9aa0cb27a649d8715c69b4b0f973734","ssdeep":"1536:gUVMbzYXN+W6PtuinSD1acQpV89cqs04IQWcJt3fiFJ:xgYNy1Jn2aJVKs0MdJ1c","tlshash":"c0630205a58565cacb3bc017453e9561e51424b5c5548ebbbb3ba2eeef0b03e3227c3b","first_seen":"2024-12-26T20:26:09.914735Z","last_seen":"2026-08-08T01:43:15.189506Z","times_seen":246,"resource_available":false,"data":null}},"time_used":3331,"timings":{"blocked":1186,"dns":0,"connect":0,"send":0,"wait":1295,"receive":850,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/kc523-1/sponsor/sponsor_web_3.png?1756903280095","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.771Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /kc523-1/sponsor/sponsor_web_3.png?1756903280095 HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 40879\r\nConnection: keep-alive\r\nLast-Modified: Thu, 28 Aug 2025 07:55:27 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b00b6f-9faf\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170386=CXzjeLzZSnWI+RYZO8UcdZqmVDGdZVCSYiWo/Lxr42ckrxBysUnavMa3kRnDxxQT04v+UUW2roTp2egL1Y6416VcZUo7fK/vzX6dp9ivN36LyO+qm2G/ITB5P4pqU9zAv7SAExZyeeu8GKqOQTfktAYcTjOzlNyGzVcaioQEg+aAIzAF7/dxa+b2gTXD7Dy0\r\nAge: 51796\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: DD50C065-35B5-4E0B-97E4-4DACFD50A7CF\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40879,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 428x169, components 3","md5":"c26161f438986f6e2d677c34d653285e","sha1":"faf6c47a013a9944bb8cac197688908422992039","sha256":"58d11e173550b3420b35c4e4be3eeb76b59ac790d9fb59b535ffe55d3b470fa9","sha512":"97649de556447ef6aa6cdd7d0bec46837cfb328335daa3b862cbaa5e23ca5a8f2af296703c9e961cbad02bb797ebf1f99ced2d1d245fbbb3a428e39d26428c76","ssdeep":"768:ub+4OMIuYE3McXMuDR64Q7sRFKJdsCA1Hunj5tyKxGGTVtkDGlT2oTO:uS4OMXYODNDR6XsRFisCAk39t6oi","tlshash":"db03f108254f2d4466ec90bbc7a1e0f7ee1d103dddb7e30c35a685163e46ca559fa0e6","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.577131Z","times_seen":2346,"resource_available":false,"data":null}},"time_used":1178,"timings":{"blocked":873,"dns":0,"connect":0,"send":0,"wait":303,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/bj.ada43481.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:05.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/bj.ada43481.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://f214n.xyz/css/home.1756903329400.edf3cc73.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 439504\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:11 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83893-6b4d0\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nAge: 51798\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 82A30623-90A1-415D-B67B-BD5881F0D04C\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":439504,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1920 x 927, 8-bit colormap, non-interlaced","md5":"2c55f8fcc8edb773be5014d8deb72c4e","sha1":"e7e55505bf22de833ec6b82a229e70bdba93b58f","sha256":"21c44535cffd825752bf9a535001b4b605147e3434cf2906fc2c8fcdcd992c1a","sha512":"bab93e8eb191df623bd7e238ae8d5cf7feae73e2a768d7b591d4dd8b7aafc199fce7c34066a272fc9137959a78a6bcd9fb388f39d4a0938f5674aaee815a3cf7","ssdeep":"12288:K+TyFzCVXhEu0hvb3kkjOO9FNkh4k6yvwUKA4AuJiT9h+:tTyFGjENkkyOWh87UK/JiT9h+","tlshash":"739423b1df0b89c858a39043dc74f99263e8d0a6bdc40ab80bf14b9176709dbbbf5116","first_seen":"2023-08-17T12:39:32Z","last_seen":"2026-08-10T17:58:48.277543Z","times_seen":2508,"resource_available":false,"data":null}},"time_used":2657,"timings":{"blocked":1746,"dns":0,"connect":0,"send":0,"wait":300,"receive":611,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036f","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.164","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:06.730Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /ecb/8f83064249b06e0660afdb30b60772fdcdfbb3036f HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nContent-Type: application/x-www-form-urlencoded\r\nx-request-source: https://f214n.xyz\r\nXign: wGHf7qJKymZlAmqnnINPj+x4JImFp5OGkSQFHG+KObZ/vBck76n1w7vKndQbQCmYShopgwQiGd5tG5CPOoaf3Q2plTbRefkI0SowSsH6DKEtGub9gQYKbr7RtaEbkDJrNxL0phxP3J6eFUJU5envwv3+zctyK3MfxFhZh0DBHco=\r\ntimestamp: 1766170386704\r\nsign: 4i1j7j3k427r1g7v\r\nversion: 5.6.8.2\r\nclient-type: web\r\ndevice-id: yhh6jce8bMArWYfRFFEGGkxjZST2BsGN\r\nlang: zh-CN\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:07 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nExpires: Fri, 19 Dec 2025 19:03:07 GMT\r\nCache-Control: public, max-age=600, s-maxage=600, must-revalidate, stale-while-revalidate=30\r\nX-XSS-Protection: 1; mode=block\r\nPragma: public\r\nX-Content-Type-Options: nosniff\r\nStrict-Transport-Security: max-age=63072000; includeSubdomains; preload\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true, true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170387=M2jpxeN9tS4ojruOp8nMsKvQAU7ARs0Td1mGhY9xzvcO6UVE32NjP+txVy83OkO/+BoaEbsWjM9d7IAoN+VNUYuv3T/pI7L8TWnFEoVoiAg8X39DgDTEMPa9wSRHrph1N+GV3zqbOdCb2w/mk+dDKXZnDf+gBiLd2BFODuS2zI/QXB848hFiCkuXtZ1aNdhF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 5F825DEC-A8B2-46D4-88AA-C0E8BA2E6162\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3828,"size_decoded":0,"mime_type":"application/json","magic":"data","md5":"6ee2b4c9c85937ff373291ea5983deea","sha1":"5d9d7585591c328a1ddb7d24fab7bba6c41de4a1","sha256":"dbab52211ff366665c0a33d855487a41b2b5e411bdd8dc52a5c8afd36081f761","sha512":"e021cc607b1569c3e90c2c53b7e105c03360aba5cdce9c01804354070b497b396fd8adf74e613e312a49049dac714ac97eb4b266312edc6cce89894a8134a854","ssdeep":"96:eOG3iMFIo4t+WuQZnHcSssJ1OIWOC2VLiyxtxQaUhfchDsjdnNXVXdIEs3uJ8jc:VL0Ku485sJ0OCMxtxQa35UN7du3ij","tlshash":"ffc17c08f690b7948b4643f674d611f9920b18bbb68b7c7dc7b0837b0407602820e308","first_seen":"2025-12-19T18:54:13.87047Z","last_seen":"2025-12-19T18:54:13.87047Z","times_seen":1,"resource_available":false,"data":null}},"time_used":923,"timings":{"blocked":466,"dns":0,"connect":0,"send":0,"wait":456,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/d5ca43969bae470d98f7e12b9052d4eb?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/d5ca43969bae470d98f7e12b9052d4eb?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 41506\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 13982\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"d5ca43969bae470d98f7e12b9052d4eb\"; filename*=utf-8''d5ca43969bae470d98f7e12b9052d4eb\r\ncontent-md5: +Qjxz9uhdIfOkFP3wA7zmg==\r\ncontent-transfer-encoding: binary\r\netag: \"FrK-53_AaaNYAtW3HxzPHNYELf1i\"\r\nlast-modified: Sat, 13 Dec 2025 19:09:42 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: KjZSW7mO6\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: fxMAAABXmw7lpYIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41506,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"f908f1cfdba17487ce9053f7c00ef39a","sha1":"b2bee77fc069a35802d5b71f1ccf1cd6042dfd62","sha256":"4a8967941cad1617594d4d19979d30048464e705f2d59cba860a3c9faaf37480","sha512":"e1760887359009203147109d799b0dc5c25ad8f5670a16b71c15ad05d4b46e441453812356a0a9fb15477f89e27eeea9dd2ff34f72777cd3528645c4c3b3807a","ssdeep":"768:kYh0gfd5Y2LmFZV/1Gx6wjBnmsyW2kLJ5FbStS1OujduPwanvl6ItMhv:ztFSgtlk9kN51S01Judn964Mt","tlshash":"2813f268c1c694110a373c7d640c58f8b89fceb4c9fb96dbc4a7b8131d1c425575a7ea","first_seen":"2023-11-01T21:19:41Z","last_seen":"2026-08-04T04:03:38.643714Z","times_seen":204,"resource_available":false,"data":null}},"time_used":3129,"timings":{"blocked":1194,"dns":0,"connect":0,"send":0,"wait":1295,"receive":640,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/47f5f835274f45b0b7f4888c8351d6d8?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.626Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/47f5f835274f45b0b7f4888c8351d6d8?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 26503\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4971\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"47f5f835274f45b0b7f4888c8351d6d8\"; filename*=utf-8''47f5f835274f45b0b7f4888c8351d6d8\r\ncontent-md5: 9dqPyRGlyhOTmESNaWnacQ==\r\ncontent-transfer-encoding: binary\r\netag: \"FvO4uAGpxxtoz2oVBAh1V22FtIB2\"\r\nlast-modified: Sun, 14 Dec 2025 19:03:44 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: IxMhicGit\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: pJ8AAAAR_jUXroIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":26503,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"f5da8fc911a5ca139398448d6969da71","sha1":"f3b8b801a9c71b68cf6a15040875576d85b48076","sha256":"e33e5ebafa3cc3f1d0f762822dc5f7f1584896e6233ed5df737cd1089fcfb4f1","sha512":"0c37173643f214bd230a93602fff04a8ecd2a299ca209e2a75e397e1f9d4e5de482aa1f323abf45c20fed95d05d72aaf114cef82f30af23bc06aabd66397cdc2","ssdeep":"768:mfrXvpZJ6fEMS+EZCbcucXqOLtb8DraUwnorpVOz9oPvV:WXvzJ6fPSrTTLtAKUjrzOyXV","tlshash":"62c2e176ab2376ebb7122c2208b0f294ad9291bc5cac1ff2ad2a2751574133d0dd547d","first_seen":"2025-02-26T15:38:27.683331Z","last_seen":"2026-05-24T05:41:01.36265Z","times_seen":254,"resource_available":false,"data":null}},"time_used":2943,"timings":{"blocked":1176,"dns":0,"connect":0,"send":0,"wait":1296,"receive":471,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/4fa5c550a1394fe5aad8d7b6071ace99?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/4fa5c550a1394fe5aad8d7b6071ace99?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 83025\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4971\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"4fa5c550a1394fe5aad8d7b6071ace99\"; filename*=utf-8''4fa5c550a1394fe5aad8d7b6071ace99\r\ncontent-md5: //vrqnoMPC236NY3o94YEQ==\r\ncontent-transfer-encoding: binary\r\netag: \"Fgl6d_of5wauQjNGpeBPit-gjClh\"\r\nlast-modified: Sun, 14 Dec 2025 19:03:48 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg121;QNM3\r\nx-m-reqid: 23rRqOf49\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: eI0AAACVmjYXroIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":83025,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 299, 8-bit/color RGBA, non-interlaced","md5":"fffbebaa7a0c3c2db7e8d637a3de1811","sha1":"097a77fa1fe706ae423346a5e04f8adfa08c2961","sha256":"3ccd57ce05469fc7a117b2bc011fd152e6c62e836c1734ee5378d5d3babc1547","sha512":"f971814cc22ef4ff522c1363789a974775d99ff0b55771b0a5a1069393f98a2d7c14f3eb78d3ece0e8a3ad6aaf3e2386e87b1c8a8aac5f1599c4651c469808ee","ssdeep":"1536:iW9X9mAm/JgBDzvWeuZYkm2vOK4T0lL3MVMo+otPv1S94cAVbCMVC2:19sFOuZYKA4uTPrTCS","tlshash":"ff8301cc92ce6ccaa217f5ba8f0f0236eb10d4159f72b9181fe36092658a5de031c6d1","first_seen":"2025-09-22T06:10:02.390443Z","last_seen":"2026-07-18T18:46:19.947099Z","times_seen":213,"resource_available":false,"data":null}},"time_used":3314,"timings":{"blocked":1168,"dns":0,"connect":0,"send":0,"wait":1295,"receive":851,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.613Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_e50c5112-b480-4217-95c2-f187843fa431.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:13 GMT\r\nContent-Type: image/png\r\nContent-Length: 394695\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eHyQAe3a8a7bsD7CudDTaaZe6FCJ%2FYsfTZjANCizvdUN8FK%2F%2BJd2R8KALKKEAAPEXRYqbd4k25IAlKdaqoMfW88%2ByoRJdZqfDSr0DDPUzLFmnl20ftESogCphhkV\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"ca824a845494796bec5f55ecc8538334\"\r\nLast-Modified: Sat, 06 Dec 2025 06:21:58 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 48458\r\ncf-cache-status: HIT\r\nCF-RAY: 9b047af279880955-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170393=sU39Om5p4GkOjT+B70mAD8A+a9Jwb1lKygE/02dFmF8E+N+z5YMfhoA6xBpSHoVIzCdfwloHQgLycikQcV903A0TiwDvExAnI/aMYBpmM2xCEKZQSB+ycABVEwHZkS2oryEx9gPQ2J5L7yzxX/RVzCib3WE9kAtvqoge1Cn9ab0OsiainqFrnviXaFcg3ygF\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 477F78AE-5419-40D3-BF3D-D08864B26BE3\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":394695,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"ca824a845494796bec5f55ecc8538334","sha1":"9c2b5d8af27d464f37c9d295963b599bfe2beb6b","sha256":"bebf296e754e5c331ce43009b1274293b6a1a04655c7efc872798ce1c4b424d2","sha512":"6d9d216a82bf7bc4137ddb2147f4395ecc5b2f00a530040a077121d452301246d32f43e53fc60e95a3de7f6b98f2d052a635ff1ac3499c554bfd085676f386fb","ssdeep":"12288:O3HGCN8Dz0DbOdIxqZJuaWvddMynAO+PIy:RoKCbZxqZ0TMyAOu","tlshash":"418423199bc439bb47ceaa53e18143caf8416d57ac7042df982f3c141bc9160f89ebe6","first_seen":"2025-08-29T11:05:53.121779Z","last_seen":"2025-12-27T06:51:48.739517Z","times_seen":278,"resource_available":false,"data":null}},"time_used":5219,"timings":{"blocked":4900,"dns":0,"connect":0,"send":0,"wait":299,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:08.638Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /jumpto/img/https://rcf-img-hk.464fdghjss06cn.com/202503/_raw3_size649x578_b82399e1-d771-428f-9811-f7e15cda0f21.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:15 GMT\r\nContent-Type: image/png\r\nContent-Length: 629518\r\nConnection: keep-alive\r\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kngCTLrL9h6F70Tw8BDL0hdjBwgKcc2LqyBHoUCMYaUJl8F28NCQquMtwjLvBZqImeHbKz3HbbJ2JLMC%2FV4rcNh2Nq%2BACjKHq0gFyHJHs2EAlYBm2nR63L%2F9azfz\"}]}\r\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"aa55c486b79391c1941b56cb91877917\"\r\nLast-Modified: Sat, 06 Dec 2025 06:26:16 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nAge: 51771\r\ncf-cache-status: HIT\r\nCF-RAY: 9b042a1aff6b0893-HKG\r\nCache-Control: max-age=2678400, public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170395=gDVZhqmaIEHGAdB9JkBwvHtoNuS8ytBBbvLxjesN74BvPV7Y/RMDkl1ZcasSEMWYA9/ZtOzMxifYXsPGUteHEF5jr1RbRTViHGnbDIBA4uH4WwOXFqbRMMSxCKXO+uwjNEvzaUC7FcmV+CQxTsyOIat2BKYFyCRbKTxPJpUBBWAFAvCyCpFcvIF5uGCslbdl\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: F4431207-3B0A-4529-9A9C-927231BF5D17\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":629518,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 649 x 578, 8-bit/color RGBA, non-interlaced","md5":"aa55c486b79391c1941b56cb91877917","sha1":"1631920c0376407ec024a2d73ecd232133eacd6e","sha256":"90492990a14abfb00e0f80a0dc410438868da9f50a1fa1375c5b8a0d22fe4579","sha512":"c35b5cbe89015905fa5ebcd3e57ecb40caa4bb411df88e24750604cda84f81e9772af3d0d5a46d06bc94c08b5eb561a951c5ddf2334a6e5e280f88a71d6cf91b","ssdeep":"12288:qJvko6vExt9aRTprkNOfDDUgXbZk9oGKbPCiAV9w/qvNU:q2b69gZC84oBIbwqU","tlshash":"4fd433a4ea76d7e1fb432618031c6b1a13a0537a27d0e291c28fcf7c9a41db65379352","first_seen":"2025-08-29T11:05:53.132796Z","last_seen":"2025-12-29T13:58:58.080419Z","times_seen":278,"resource_available":false,"data":null}},"time_used":7810,"timings":{"blocked":7146,"dns":0,"connect":0,"send":0,"wait":318,"receive":346,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/css/61540.1756903329400.030a612e.css","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:01.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /css/61540.1756903329400.030a612e.css HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:02 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68b83894-59bbc\"\r\nCache-Control: public, max-age=31536000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nContent-Encoding: gzip\r\nServer: Nginx\r\nX-Safe: 1766170382=fD3dUXvTAvqkKlHn3bIXCn0ldYgCieEWsInrTrUy2OYSNeSM3Ocx74L28Ir9Qu5IZZNTVdLIdSEvgdjLQMGdKY8rAwJgkpF4uDVhyWLRwemAIwfZs+oHw1mOuVEVgwYh/ydxqVefveJNFmABhM/gLFLt+3W80dYlTLRrtHmJoHD8gkh4JbcBxTMn6BGv6EQe\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 4E7EFF30-CECF-4FCA-8937-78B2EE04555F\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":367548,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"ab44c516a5aa84faae3bbf2852ebc655","sha1":"ef60c256d0028ecec909ffd9895ea2e63c1d1f1b","sha256":"456781f16fd25de012286211ad4b06e5ce32d9dfc9fb28a2364d80f76a2994ea","sha512":"4e214b9fc84d1e3b914c9bd025947162323db0251c704c668fafbbf226e604899d9d8d21e2f8b3b401ddb966981ba0edc97cc87c6ddd3eef29aab80010446656","ssdeep":"6144:z4+4r0H8Tu4+4r5cRlGuEQUQ929scKGnpTPIlyJ:z4+4ZTu4+4FKLlyJ","tlshash":"de74fa7caf1030ae15a7cb27b660f5589c36a443f9bfde9af3a53d580789a510623c13","first_seen":"2025-08-16T16:35:14.576567Z","last_seen":"2025-12-29T13:58:58.009689Z","times_seen":607,"resource_available":false,"data":null}},"time_used":2241,"timings":{"blocked":586,"dns":1,"connect":292,"send":0,"wait":580,"receive":477,"ssl":303},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"photo.365live88.com/img/fb/team/04b51fb2633244fd989e50191e378ddf?win007=sell","fqdn":"photo.365live88.com","domain":"365live88.com","tld":"com"},"ip":{"addr":"154.41.93.241","port":443,"asn":174,"as":"COGENT-174","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.631Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"photo.365live88.com","organization":""},"issuer":{"commonName":"Encryption Everywhere DV TLS CA - G2","organization":"DigiCert Inc"},"validity":{"start":"Sat, 01 Nov 2025 00:00:00 GMT","end":"Sat, 31 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"45:76:43:9C:31:C5:89:A6:99:FD:9B:D8:6C:A9:3A:E6:2F:D6:E9:80","sha256":"73:27:CF:D8:8D:AC:95:46:00:5D:67:05:1E:70:22:3E:17:F0:94:78:CD:6F:A6:9C:C8:5F:B5:3B:75:60:3D:C8"}}},"request":{"raw":"GET /img/fb/team/04b51fb2633244fd989e50191e378ddf?win007=sell HTTP/1.1\r\nHost: photo.365live88.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Fri, 19 Dec 2025 18:53:09 GMT\r\ncontent-type: image/png\r\ncontent-length: 36905\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: X-Log, X-Reqid\r\naccess-control-max-age: 2592000\r\nage: 4970\r\ncache-control: public, max-age=31536000\r\ncontent-disposition: inline; filename=\"04b51fb2633244fd989e50191e378ddf\"; filename*=utf-8''04b51fb2633244fd989e50191e378ddf\r\ncontent-md5: JqWf5WU6lrpy9PHk4IttSw==\r\ncontent-transfer-encoding: binary\r\netag: \"FlaeklOhB_KHRNlX9nKcwiDbBfrt\"\r\nlast-modified: Sun, 14 Dec 2025 19:03:45 GMT\r\nx-log: X-Log\r\nx-m-log: QNM:wldsg119;QNM3\r\nx-m-reqid: tkxOVnPLm\r\nx-qiniu-zone: as0\r\nx-qnm-cache: Hit\r\nx-reqid: ubAAAAATJn8XroIY\r\nx-svr: IO\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":36905,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 300 x 214, 8-bit/color RGBA, non-interlaced","md5":"26a59fe5653a96ba72f4f1e4e08b6d4b","sha1":"569e9253a107f28744d957f6729cc220db05faed","sha256":"02cc62d168d694dfcf78c720e1049fc720c2af87cc757881f35b0d18b23dadff","sha512":"37f121e7b2a0b2481d1c07af1137ec53cea806c0bc8d12d45dad0c95917d421aed666155ebefc083ecfeac4364350f31f04b6a7a19a15ada88fd3f3af7e77ba8","ssdeep":"768:WVl5Uhnw9AnQLXgcifcMRIUEuVn2P5yQSdHdKA8gSZScTe1F84wxVPa+N:42nwigvifNxlMDyKZgI4wxVPaS","tlshash":"aef2f240fd66ed89b004c0dcb34edf804553aed1e669341d766618f22ca8beb293f95e","first_seen":"2024-12-20T19:29:54.009921Z","last_seen":"2026-05-15T23:42:44.63685Z","times_seen":176,"resource_available":false,"data":null}},"time_used":3118,"timings":{"blocked":1171,"dns":0,"connect":0,"send":0,"wait":1296,"receive":651,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"f214n.xyz/img/LIVE.88ccbf98.png","fqdn":"f214n.xyz","domain":"f214n.xyz","tld":"xyz"},"ip":{"addr":"45.196.247.168","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://f214n.xyz/","date":"2025-12-19T18:53:07.809Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"f214l.xyz","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Tue, 16 Dec 2025 09:36:16 GMT","end":"Mon, 16 Mar 2026 09:36:15 GMT"},"fingerprint":{"sha1":"4D:1A:8A:58:3D:90:83:1F:21:F7:41:0A:A6:06:FF:C2:A3:BC:D4:64","sha256":"94:33:60:AB:7E:EF:85:94:2B:CD:D2:65:56:C1:E2:9F:4C:EA:49:EC:8A:E0:30:86:89:47:1D:24:AF:58:71:AC"}}},"request":{"raw":"GET /img/LIVE.88ccbf98.png HTTP/1.1\r\nHost: f214n.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://f214n.xyz/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Fri, 19 Dec 2025 18:53:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 61665\r\nConnection: keep-alive\r\nLast-Modified: Wed, 03 Sep 2025 12:46:12 GMT\r\nVary: Accept-Encoding\r\nETag: \"68b83894-f0e1\"\r\nCache-Control: public, max-age=2592000, immutable\r\nAccess-Control-Allow-Origin: *\r\nX-Custom-Check: true\r\nServer: Nginx\r\nX-Safe: 1766170388=wNoo6UDfaP0s04QKZGp4HtUPA15rzPBGH8y5qTaOH75dbIZJcU5sJbvsCwyjTJq6O6VM3y5PbYSOBOzk246XD6MtZdNA8uK7Tc7jDadUVo4zwSUHAB+nZqJKiz7/Tq0wC9OQPf/udb/ewOz1eXuSIBE5XmZPBw3Cz6Etuqvkw4icqOtcA1diFtEmC7u8sDUg\r\nAge: 51783\r\nX-VIA: l1=P3OZ0mtEcme3AyWm\r\nX-VERSION: 1765881287\r\nX-Request-Id: 87B5A3E8-5DCD-4E21-9D3A-1B09BDE5B73F\r\nX-Cache-Status: HIT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61665,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 582 x 307, 8-bit colormap, non-interlaced","md5":"372d01a2bda7ccdca1e7966af39c2327","sha1":"d438c1947b711d032c5621a6b4b08bbbca2c338d","sha256":"4eac7be4c06fa607ef5e95789e3ead43806bfeff97872ed6567e3810f2f661bc","sha512":"9f04160df8696cf984cd77604dddaea73969479e4f1c5050e53351df7f11e85d8ecccb14ecb87dcd58bea0ba04d9ba5ea3f99c69a179ba88ad38d5416b7a94d3","ssdeep":"1536:jTjrlfQBxhFWiXt2lnJE9mARbSK0k2C8ve1HfarCtt:jH1QjwWUC9mA10jC8WZfaQt","tlshash":"dd53124a2ecc3a1f7bf21e5e06f286814d36a186d0f9ba5bc6e70ef1218521de0e4535","first_seen":"2023-11-10T19:12:00Z","last_seen":"2026-08-10T17:58:48.447669Z","times_seen":2378,"resource_available":false,"data":null}},"time_used":1141,"timings":{"blocked":503,"dns":0,"connect":0,"send":0,"wait":324,"receive":314,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2025-12-19","alert":"Phishing Block","trigger":"f214n.xyz","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-12-19","alert":"Sinkholed","trigger":"f214n.xyz","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}