{"report_id":"5e2bed53-7dfc-49f2-8f19-eee9b1573d2b","version":6,"status":"done","tags":[],"date":"2026-01-14T14:53:58Z","url":{"schema":"https","addr":"ccetus.com","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":0,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"final":{"url":{"schema":"https","addr":"ccetus.com/#/pages/common/nowallet","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"title":"Access Cetus using Coinbase Wallet","dom":{"size":761034,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (51571), with CRLF, LF line terminators","md5":"f1ca62aa95a9cbdc5130f9d33e76fe00","sha1":"40913096ac05cceda067fe55250a0a7aea06de58","sha256":"1e6b92f318fa5401184ccba2d128f51c4e960c84dbddb7809fbc35314d9c9e55","sha512":"30f3933c8c6d793fa9a042c7747e8214143786c907853055b58e6fdbedd8ade47dc78709f851b40590e80f45a42ef0f5deb39191d16f3a7d0a404de34b2064e8","ssdeep":"6144:xPrr7fnFiNekZdwG1ZAIkKDJ3bys5XrHeg05TUEajki//2:Zr3nOZdwG1ZAIkKDJ3bys5XrHeg05TF","tlshash":"65f49ce3bad82048a037c65ac642b7bc793fbad243525dd79b4637318f526c7260861f","dom_hash":"domhash791a790b6531d7be893ea9adfb70d951","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ccetus.com","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":0,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-18T14:53:58Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"ccetus.com","ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"domain_registered":"2026-01-13","domain_rank":0,"first_seen":"2026-01-14T14:53:59.246425Z","last_seen":"2026-01-14T14:53:59.246425Z","alert_count":38,"request_count":38,"received_data":5462346,"sent_data":19311,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"admin.cetusexz.com","ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"domain_registered":"2025-07-31","domain_rank":0,"first_seen":"2026-01-14T14:53:59.248513Z","last_seen":"2026-01-14T14:53:59.248513Z","alert_count":0,"request_count":5,"received_data":29929,"sent_data":2532,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.221.80.91","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-01-14T11:37:09.481821Z","alert_count":0,"request_count":1,"received_data":578,"sent_data":441,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ccetus.com/","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d6b954dc2d01b7f947ffbdbc08419c4","sha1":"91b4d1da374271f3f7a26ace5bb5d9a18cc7833d","sha256":"33452930b33391ee5b905f55ea3d83da98c22f96e001002468f1230369567e4e","sha512":"0edd93b88ed4f3b4e519ecaf80b84a9226198637f31e617f182614a579969c77e65863f98bda78349defd5054b0de9daff0d03b9299fdf432a72ca1b28191074","ssdeep":"","tlshash":"bb6000c3c03303000c0033ff00c300f00000c0000000f3003cc3000330000c003c00cc","size":16,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-23T15:53:23.504144Z","times_seen":973,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-follow-index~pages-follow-trader~pages-index-home_search~pages-market-search~pages-nft-artistD~29b73d58.13901a78.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"125228f6a10ea4aca853b17d4a68677f","sha1":"9f6eb508dc6be937fa9518206f10d9445cd89b01","sha256":"71218383eafbd08bef0476ccba5fc825b9b847c093a38a6c2c043a5654a8b468","sha512":"18333610a9d1173cd318b12b71221191d0c75e37c217ae803b2aa20f6d47242acbacfbd50f0db0143882765dbd44a24fda591a3c3d654aca0571d238d453ef73","ssdeep":"192:w6uXDgAkhM4Hs6zJq1Bfo4R6eBl7gyWTg344mU3qKQ+hxMP1x8R00gA7isgO/G/N:K2ti+c4AaVX5P9pIKwg+k46ho56yAqa","tlshash":"b64329c2f5da30244167cbcdd151b2fc9abaab6302836cd2ea813f314f365d6652671e","size":59559,"data":"","first_seen":"2026-01-14T14:54:04.357671Z","last_seen":"2026-01-14T14:54:04.357671Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":true,"md5":"c7c2044589cd6c4afb8f708d8f4929ce","sha1":"0a1a91f258a6b31b5f24008bde88fe949fd00317","sha256":"20217fc70ebe327eee12ece90b2c8ad0e6f760234c316849f05b7e2a7d0ee931","sha512":"50894a9f5d6c19842e74141d8b09cfc2ed951ee4d75dd45343c8c9156064fabc2129acf0c4635cfba00be760064af9293e826d7df958097177d67e364bb11248","ssdeep":"","tlshash":"25c04cb4761959305659a22d7239e7d83dbb501130437547901c158d0cf4e945671ea9","size":159,"data":"","first_seen":"2023-03-07T12:06:42Z","last_seen":"2026-07-24T17:25:15.914352Z","times_seen":1408,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/common/js/touch-emulator.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"178ba7db6232252a555ba6ff953756a8","sha1":"31129606e2c7e395a73184f30e81e835a424cdf5","sha256":"2968f310031c7a0c1d271836caa44aedaa28794289d14c577f0b17033e8c036d","sha512":"dea2f867ed3e1774320ea9494c9fd6fa24a7c7eeba27e50099530d3eabe196b6a34f70cfb7d0ac87aa5c70dcb5172d149de92da8af78725b6090952588041dbd","ssdeep":"96:L+vx+c5tJzNjX/wGiZ27oA2qMrttS7KDWom4RhvYahnT/TCKkTIT1/CoShwqhzcs:yvx+chzxItcKs+LmKk8TqhzwoEPq","tlshash":"1a32314f098a226204bb7329fb9e904af67e85a311012056fcbc5f653f72a758694ecd","size":11668,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-23T15:53:23.455004Z","times_seen":719,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-index-index.aeb63724.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"925bbefa2e8fd8816a34226d36fe98ba","sha1":"5ab44f23b2a1097f3504bd5fd3f442e5a2b2f1e3","sha256":"0ead64b93bbb99b16d2a930c89812390f50974cf4788e30fe3d535df7785c6cf","sha512":"3fdefb8b6140e08b5a90543712daf22bc5d4f97f29bb329ea11c865453362036552907c25105da5ada2f956c72ae0d37f8f8e384e40544ea80184372f93b466b","ssdeep":"384:QOYajcF/eLshg4qWpEestkpzvfRq/yPtSqqRFtD/+KLhf1q:pcQXesqNR+yPtZqRFpNq","tlshash":"9f734ba3fdcc2214856bc719916122fcb53bea735283d9c3e4437fa46f1a5c66e0e918","size":74153,"data":"","first_seen":"2026-01-14T14:54:04.370028Z","last_seen":"2026-01-14T14:54:04.370028Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-c2c-c2c_mine~pages-setting-left_menu~pages-setting-preferencesetting~pages-setting-setting.c3e251b9.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"516fd311e2d35b6965cb1c9971a3677c","sha1":"cf74e45297656326490d838119e1fc0ea09b3328","sha256":"4c1421fb9a951c3ea0d187d63485b971214bd85bc52f30cf13712ceb8d1e4e1d","sha512":"95fea9888706a332495442c999922478bd756c24e099d2dc716ce4912c7e39776e3e9ac9173090468bb45997c99aea8ab9d918c79b43cd886fd310795bf8526e","ssdeep":"192:v9yIzhBslXEPRJyfJA6JaQOOo7SqRYznhgbzCxKneLdSyIu3AkJRoOwaE2v2U26f:v9/ku2qRsnhKnepSyIu3UuIXTYU+7","tlshash":"2643eac2ffd8a00ce577e7019149b2fd9a2af963428168dad8c16b344e965cf6f0e51c","size":60397,"data":"","first_seen":"2026-01-14T14:54:04.34962Z","last_seen":"2026-01-14T14:54:04.34962Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-setting-left_menu.0fd6652b.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"21b0d8527658be0b5176b6345778e9e0","sha1":"df3d4dea7c39e7c3b1e96871aeb9cf403fcd9f9a","sha256":"a12dfaabe5a8ddc9fbef947c6134b7871deff455305efdb356aad09287b1b44a","sha512":"42878caae47429906121640f30ca97ddf3b05980416cd37113893a5b5ec67d34636f1054fe6c79e579f623cd8338b9a3b4ca040b6cb37daa6514a9c330ec2d2b","ssdeep":"1536:+sidpNohOOwvYVshFos6lRHMbVQsJrJqT9hF9Z:XOOKY+cVMB7+","tlshash":"14b346a2f4c8e0884517c79950023ab8af3a5973d2935963d7ffbfb04e519e62b046dc","size":118176,"data":"","first_seen":"2026-01-14T14:54:04.346381Z","last_seen":"2026-01-14T14:54:04.346381Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-common-nowallet.d444fbb2.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"introduction_type":"scriptElement","is_inline":false,"md5":"8372033a3ec5fa4595b58f3aa02110f6","sha1":"a1267b6f6cd8b3d965929a1964e99e7944f1eee1","sha256":"c28ced31c22c743c292788fc74ac6dbb96a927677c134ac83d3077f4e9c2f8de","sha512":"85db5614369bbf0afc371a18839685d95fddbf73ff0ad3d16640435d25baba4c50a6539b2aab789d09654ec4b84c6695caa64867bd64ae573a61d1573b51edf4","ssdeep":"192:maq1OPqBVXobJJ6fBG4TgY+uwhaqLsPNBSnV4Fe7Ub1YQCmRSaxFAa4WK2X2i2oZ:mdaYOQqLsNXe7UBYQCmRU+cVQ","tlshash":"f543b6b2f7d828246367c7439543b2fc9e3aa96302016f5fdac37b245e17bce652051a","size":57071,"data":"","first_seen":"2026-01-14T14:54:04.34845Z","last_seen":"2026-01-14T14:54:04.34845Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_my_home_flash.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.675Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_my_home_flash.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 755\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-2f3\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":755,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced","md5":"4aadaefbf3ba3a719a9eeede5ca315ef","sha1":"87142f4189405e69968c1df54df2376bce1b6859","sha256":"5c53c12efd31fc3113059dbabb2f3d30011105d87eb918086f33babfdcab4ae6","sha512":"2c07891577cc19b99ca02d026b1c4fed3ca4801af3ef949899e5557c6deb4bd762683b8d35e6ee0cef17951173dc8f5a0c04afc92a99743008219d1bc522414d","ssdeep":"","tlshash":"e30175c9dded3a24478c16f0501504fa0c9a1b6246e1b7d90030e964caae03946b77e0","first_seen":"2025-08-30T13:19:17.525084Z","last_seen":"2026-05-24T23:31:20.62543Z","times_seen":3,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":374,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_my_home_part_plan.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.681Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_my_home_part_plan.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 751\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-2ef\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":751,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced","md5":"e5dc091c3d130dd66669bfaf7a6f240a","sha1":"ae4c36e558858aedb9591053cfa25648bda01b2c","sha256":"dc9dec8062c94302c9a51fc5fc88377ecbe0b9933f642546981401442ca60d68","sha512":"3cf605065cfb23575d3615097ffc08a90c1c2dd4260eeff19f725afecb6eca92dd9d21b974cf8eb5498d29bb265178135d159049257e9643d68e76a761014454","ssdeep":"","tlshash":"a001b5f28f53cc07422f47baeb2e4860c07164a6e6acc352b0bcc2583af11d689803c9","first_seen":"2025-08-30T13:19:17.493191Z","last_seen":"2026-05-24T23:31:20.635356Z","times_seen":3,"resource_available":false,"data":null}},"time_used":378,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":378,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/iconfont/iconfont.woff2","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.693Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/iconfont/iconfont.woff2 HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 32744\r\nlast-modified: Mon, 12 Jan 2026 00:58:53 GMT\r\netag: \"6964474d-7fe8\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32744,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32744, version 1.0","md5":"5b8f35b173333c5161098c675e902401","sha1":"c33837d28eff55458d49ef00e68ae9a04da46f05","sha256":"912327f77b1b2d3092e0cda25efdd0c5045ef17d018864d1cefba33db7727fce","sha512":"38a8b9a82c69376f1664e4e76f31605a6ad31e611e2f282c46a40044624072a48ed8f9fd49735136afbd21ba61cc9ac9795828e6fcb33ad4b662bd41cf6b4084","ssdeep":"768:9P1NcXcebJOUlU8WQKAfiDvCcj+IWL3OJ:9dNcXceNOUSD3AfmCcfJ","tlshash":"cee2f1303175ab40c3e6ef396e7b1c46d8724a3892785ee1e3d16e4d142bccd19d5a2b","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-23T15:53:23.484958Z","times_seen":426,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":352,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_home_menu.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.008Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_home_menu.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 617\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-269\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":617,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 60 x 60, 8-bit gray+alpha, non-interlaced","md5":"2c0135de8bc5a34e3ef9e9413d80fd98","sha1":"1558ee3f270acfc0239694da01067b8b5d39ab2f","sha256":"8720d1e3ab235a0d6cccc745980e386f1c45686e735237ed99f7deecb32fa727","sha512":"253a30f3ee324f890b2b0985529083c8b7c766cfc5a2671e974868e9495dd73f27382f702f745c9f619cfb521f2ad91f6d936d9e15f2e1e89d894c07c3f7f455","ssdeep":"","tlshash":"40f062ae838cb9b7bc3f04350d70d3f2c8a85e1100a44f3552a9f0dc5981b888cc2780","first_seen":"2025-06-20T02:35:28.056678Z","last_seen":"2026-06-25T01:18:10.510993Z","times_seen":80,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":197,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/default_head.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.641Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/default_head.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474d-7ee6\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32486,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 404 x 405, 8-bit/color RGBA, non-interlaced","md5":"f456500f839873cfec13ab48653ee66c","sha1":"746291a984e383e415c06dba9f7a24d64f9994f6","sha256":"f931f7b649572f268b03157f5bbe1b64f01e3b9998250d0402b568dc08caa571","sha512":"474ee30c1262518908d38d1a9bf565f684cfde1d77b25ef9c41350d59dc671a4e46dcc4c763cefdb1b60d0ac8754d5016f958f6d92a157705f00fa29c5a1d3bf","ssdeep":"768:1yg87vKUfhDQonPlNwQlPN00UfaWrEA9iClIm3Epa9:IdTZrAgs+4CqEk9","tlshash":"23e2e11542194f5610ac296fef0f1dc0cd86199b2329bf4f1491ba9e13b85fab42c4e7","first_seen":"2026-01-14T14:54:04.340846Z","last_seen":"2026-01-14T14:54:04.340846Z","times_seen":1,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/icon_arrow_right_white_16.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.652Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/icon_arrow_right_white_16.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 140\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-8c\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":140,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced","md5":"d86aeefeb04edf4fe5e451c4241af803","sha1":"9e97546403618fedd671533cf72276f45a559720","sha256":"46ecce1ab52f003c19d0eca5128e3234251084e0502726e6410a453685290dda","sha512":"e8f2c00ca3085cf880df3ea60a0ed44fc34eed2c2f1847193694287bd6e6b95278e70111df77a2159405188df09293d61b64a53d5db4f69576642d004c692190","ssdeep":"","tlshash":"58c02b9af557ac2c8c148b374d4c0013dd0fcc6500610ebde0184fb56570121234c3d2","first_seen":"2025-08-30T13:19:17.488033Z","last_seen":"2026-05-24T23:31:20.623767Z","times_seen":3,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/auth.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/auth.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-ed9\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3801,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"1c74e31eba9dc53fb6c10b4f1345f89e","sha1":"f693770f660528f84692ab0a8989713b6960fc40","sha256":"105ece27d4266e2f237f512dfb274cb618dc6ec4f368dba7695534f28811f95d","sha512":"aa80d7057fd69fd3d4064b83b637c475741b360da1dd8b474913b3bf608c19b893bd2db64ebf7c494a43af21d114c847b839bb327bf7d4dca833eecca48dcbba","ssdeep":"","tlshash":"ad714b8705868c36d6c2c8dba34f1866ceb46e65b534679e3ea1ef4ef69121017e04a1","first_seen":"2025-08-30T13:19:17.523255Z","last_seen":"2026-05-24T23:31:20.564155Z","times_seen":3,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/common/js/touch-emulator.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:37.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/common/js/touch-emulator.js HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-2d94\"\r\nexpires: Thu, 15 Jan 2026 02:53:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11668,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"178ba7db6232252a555ba6ff953756a8","sha1":"31129606e2c7e395a73184f30e81e835a424cdf5","sha256":"2968f310031c7a0c1d271836caa44aedaa28794289d14c577f0b17033e8c036d","sha512":"dea2f867ed3e1774320ea9494c9fd6fa24a7c7eeba27e50099530d3eabe196b6a34f70cfb7d0ac87aa5c70dcb5172d149de92da8af78725b6090952588041dbd","ssdeep":"96:L+vx+c5tJzNjX/wGiZ27oA2qMrttS7KDWom4RhvYahnT/TCKkTIT1/CoShwqhzcs:yvx+chzxItcKs+LmKk8TqhzwoEPq","tlshash":"1a32314f098a226204bb7329fb9e904af67e85a311012056fcbc5f653f72a758694ecd","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-23T15:53:23.455004Z","times_seen":719,"resource_available":true,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/index.css","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:37.142Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/index.css HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-1794e\"\r\nexpires: Thu, 15 Jan 2026 02:53:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96590,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d2c05a28c7f2113821d909b7b5b918a3","sha1":"ccac94311f6ac6f580b64f47f7705318f1d226a3","sha256":"695bdbeea38a126c139158967cdd4f3a435e9936b9dff5b002e5f20a10fc7907","sha512":"3b96fbd1a89be8ae0b7479705cd4a2958ffe7f2f3f57ec23f407ad51ed8b447b9960728d77502e8fd8b2b19bf0971682030117559df250ea11c9bc1802364c3c","ssdeep":"1536:qlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nrhlvbc:hApuK7hmVrS1Wu3iG41nrPI","tlshash":"4493f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2025-10-16T12:28:28.877032Z","last_seen":"2026-07-24T04:54:18.332395Z","times_seen":1637,"resource_available":false,"data":null}},"time_used":394,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":394,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/index.b76888a0.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:37.144Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/js/index.b76888a0.js HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Jan 2026 00:58:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474d-1c97fc\"\r\nexpires: Thu, 15 Jan 2026 02:53:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1873916,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (63090), with no line terminators","md5":"3882a59f2bf581d4cf928f62f1b1858a","sha1":"918da873a57c0be87cac763f9dbd6afd829135a6","sha256":"db62780ad7c6acf9e94f9c9051482715007370d3d5f9a29793f54e9188937ec9","sha512":"9174ed1a3792d7993d2fb5185264cac41668a7a7f2d141fdb5e14a1e645767cb620083b36efefe35ef88ccd378316e58a719fc91dd7a00d54216cd1a1f2d885b","ssdeep":"24576:f7XQB0//5dWniDiZdwG1ZAIkKDJ3bys5XrHeg05Tt:EB0HzWq","tlshash":"51351986f5c4631042ebb205a543b3bc9779fe635251bccea7c1eb248f6b6c63114b29","first_seen":"2026-01-14T14:54:04.344451Z","last_seen":"2026-01-14T14:54:04.344451Z","times_seen":1,"resource_available":false,"data":null}},"time_used":634,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":634,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/logo.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.019Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/logo.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474d-f3fc\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":62460,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 996 x 260, 8-bit/color RGBA, non-interlaced","md5":"46e73e48bda895ec29b429e339cf95fb","sha1":"e58d3b2dc883b992149134c4832761023175ac66","sha256":"0ebe4ec50907e6316f3bb894ab21c435b095305a972feae160778528136a40d9","sha512":"71d2f111868a0d751fac789caecc4d91decae90850d5bbe23c4d3b1d4394648907201efe6a0a54666fefa22a401075dfb936d9a78a963741d2667d731ad18b8c","ssdeep":"1536:EkJEqw7pl4lpKm1/vSa1A6tzUItbBysYUkHjA:zJi7SpR/vLxYpjDA","tlshash":"0853f18fc2f44109ae073ea744bb7ec58fa0845b8720649cdc0a751e7b26cfd2759997","first_seen":"2026-01-14T14:54:04.345412Z","last_seen":"2026-01-14T14:54:04.345412Z","times_seen":1,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-setting-left_menu.0fd6652b.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.214Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/js/pages-setting-left_menu.0fd6652b.js HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-1cda0\"\r\nexpires: Thu, 15 Jan 2026 02:53:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":118176,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65314), with no line terminators","md5":"21b0d8527658be0b5176b6345778e9e0","sha1":"df3d4dea7c39e7c3b1e96871aeb9cf403fcd9f9a","sha256":"a12dfaabe5a8ddc9fbef947c6134b7871deff455305efdb356aad09287b1b44a","sha512":"42878caae47429906121640f30ca97ddf3b05980416cd37113893a5b5ec67d34636f1054fe6c79e579f623cd8338b9a3b4ca040b6cb37daa6514a9c330ec2d2b","ssdeep":"1536:+sidpNohOOwvYVshFos6lRHMbVQsJrJqT9hF9Z:XOOKY+cVMB7+","tlshash":"14b346a2f4c8e0884517c79950023ab8af3a5973d2935963d7ffbfb04e519e62b046dc","first_seen":"2026-01-14T14:54:04.346381Z","last_seen":"2026-01-14T14:54:04.346381Z","times_seen":1,"resource_available":true,"data":null}},"time_used":211,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/loan_icon.jpg","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.680Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/loan_icon.jpg HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 12 Jan 2026 00:58:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474f-95eb\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":38379,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, xresolution=74, yresolution=82, resolutionunit=2], progressive, precision 8, 880x880, components 3","md5":"afa5a7c0f6def63b98a00156220d0565","sha1":"62f45d8c3177ce6dcaa0982ab6c9288a8ac1bd9d","sha256":"e922efe7e4aa135637ba2fa3ee4f5158b8afb64229d331f00183e54955be1e2d","sha512":"e2281dc2064b2377a40fc62e8a8a27948377b3539fcc1113d93268b68b76e2743055b1fb32c858992de78af6699241df63ac28cd5b310ce739824bdc7dbf8d78","ssdeep":"768:+zgHdd74vQNuxsWhfP2lqy9kaFS2AAmDOpzi9H8KKL:+G/AQWhfOiaF7mU8eL","tlshash":"bc03bfa56b440242d62dd73a8e9735612a36ae391af9910ff6f41d8214fc8f90690cfb","first_seen":"2025-08-30T13:19:17.53405Z","last_seen":"2026-05-24T23:31:20.628415Z","times_seen":3,"resource_available":false,"data":null}},"time_used":379,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":379,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-common-nowallet.d444fbb2.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.787Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/js/pages-common-nowallet.d444fbb2.js HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-deef\"\r\nexpires: Thu, 15 Jan 2026 02:53:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57071,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (56893), with no line terminators","md5":"8372033a3ec5fa4595b58f3aa02110f6","sha1":"a1267b6f6cd8b3d965929a1964e99e7944f1eee1","sha256":"c28ced31c22c743c292788fc74ac6dbb96a927677c134ac83d3077f4e9c2f8de","sha512":"85db5614369bbf0afc371a18839685d95fddbf73ff0ad3d16640435d25baba4c50a6539b2aab789d09654ec4b84c6695caa64867bd64ae573a61d1573b51edf4","ssdeep":"192:maq1OPqBVXobJJ6fBG4TgY+uwhaqLsPNBSnV4Fe7Ub1YQCmRSaxFAa4WK2X2i2oZ:mdaYOQqLsNXe7UBYQCmRU+cVQ","tlshash":"f543b6b2f7d828246367c7439543b2fc9e3aa96302016f5fdac37b245e17bce652051a","first_seen":"2026-01-14T14:54:04.34845Z","last_seen":"2026-01-14T14:54:04.34845Z","times_seen":1,"resource_available":true,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-c2c-c2c_mine~pages-setting-left_menu~pages-setting-preferencesetting~pages-setting-setting.c3e251b9.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/js/pages-c2c-c2c_mine~pages-setting-left_menu~pages-setting-preferencesetting~pages-setting-setting.c3e251b9.js HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-ebed\"\r\nexpires: Thu, 15 Jan 2026 02:53:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60397,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (60219), with no line terminators","md5":"516fd311e2d35b6965cb1c9971a3677c","sha1":"cf74e45297656326490d838119e1fc0ea09b3328","sha256":"4c1421fb9a951c3ea0d187d63485b971214bd85bc52f30cf13712ceb8d1e4e1d","sha512":"95fea9888706a332495442c999922478bd756c24e099d2dc716ce4912c7e39776e3e9ac9173090468bb45997c99aea8ab9d918c79b43cd886fd310795bf8526e","ssdeep":"192:v9yIzhBslXEPRJyfJA6JaQOOo7SqRYznhgbzCxKneLdSyIu3AkJRoOwaE2v2U26f:v9/ku2qRsnhKnepSyIu3UuIXTYU+7","tlshash":"2643eac2ffd8a00ce577e7019149b2fd9a2af963428168dad8c16b344e965cf6f0e51c","first_seen":"2026-01-14T14:54:04.34962Z","last_seen":"2026-01-14T14:54:04.34962Z","times_seen":1,"resource_available":true,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_operate_service.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.667Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_operate_service.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 717\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-2cd\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":717,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced","md5":"ce4799dba0be8eac2df9258bacbe700b","sha1":"9078a1b13596347b19ebc9fe6a33ed193f78a4bf","sha256":"8669c0ff265700af6195588d28c620d369f2882c814d8c447e26383b1eeb5935","sha512":"bef70f99cfc837fe1acab56a334c5f14ec244af1f863c119b1e0017de07527dbb8f15dc3c6555e8d2e211f8a2fb8ecc198257ce43f3818356aa34746ffd2d3db","ssdeep":"","tlshash":"fb0165f293c87228c8d225e5e27c62b2bd78f1257272897c88609bd9d1136c9d4216d5","first_seen":"2025-08-30T13:19:17.539797Z","last_seen":"2026-05-24T23:31:20.613913Z","times_seen":3,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/email.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.670Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/email.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-a38\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2616,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"453beaa5f6ddca69fb40b85bed7e85aa","sha1":"07b899b3662d48003a963f066a6a884359de2bca","sha256":"39df49464ef96717a1cfaca80a9df48e0124d527a35cb780289ae47e47eab76f","sha512":"139c776e54762a9289e6878d9049770e677ab7cf467eb2512e4448df886d60bc0d335fcf00b084eeb8b7941dae42b46af0d0c03243fc2ae85161a06e2097812f","ssdeep":"","tlshash":"81513c319267975fd485c6bf721552348d742c00ce78ee508773bca66a05a587cce30e","first_seen":"2025-08-30T13:19:17.543261Z","last_seen":"2026-05-24T23:31:20.562092Z","times_seen":3,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/image/nowallet.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:41.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/image/nowallet.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:41 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474d-4d82d\"\r\nexpires: Fri, 13 Feb 2026 14:53:41 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":317485,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1280 x 853, 8-bit/color RGB, non-interlaced","md5":"ee0db273d5ca37c6c9f5fd5ad0da36bd","sha1":"474b5cbb660b4446c88b03f2a3c4298541f87ee6","sha256":"59538fb9e8e64dad4cfe969963ae3cdf67475f7e88becbdd4d40bb952cf833fb","sha512":"d6ce9e44d1150cbaca4b27b233dccc450563c18079a4ad71137a96c72d05bce6d53e978618e983af79c33c2361055173feedc555cceb288837058978b26f8769","ssdeep":"6144:EmRrnu0PguOTCccEch45lpnsnLvpRAm9tX7t6ksQSBim:EmRrnouOpcEch45lojpxtJY7B3","tlshash":"a06423b8f8e967f3ca63273849a15916fe8ac8fdb1935e326df389310246dc4168c5c5","first_seen":"2025-06-26T20:28:36.330737Z","last_seen":"2026-06-09T16:28:28.959798Z","times_seen":11,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-14T14:53:36.284Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:36 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-6a6\"\r\nset-cookie: server_name_session=3987226ec17de982f787a74514ce5360; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1702,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1018), with CRLF, LF line terminators","md5":"b0e3712e17fbc5378ebba6cb2c7182ab","sha1":"84f452704a86ecff80d5026091623acb33738eb0","sha256":"83a67d1dd4f11c446573a36680410ab23a2c3930421edff39330610de5a233c3","sha512":"7e4950945f05f0c086cce4174dfc25a204f3ba3eeb50e6d6d596029233af61cfd75a69c1c90e244c62366f596ba4fff9567409ce261b5678ab2ced5e8a067e17","ssdeep":"","tlshash":"f73130a36e01d6193220c660f47ff11c862dd22799a0f882b5d81ecd8ec2fc4cab7d09","first_seen":"2026-01-14T14:54:04.353083Z","last_seen":"2026-01-14T14:54:04.353083Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1178,"timings":{"blocked":488,"dns":89,"connect":197,"send":0,"wait":198,"receive":0,"ssl":204},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"admin.cetusexz.com/api/getWebSiteConfig","fqdn":"admin.cetusexz.com","domain":"cetusexz.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:39.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"admin.cetusex.vip","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Dec 2025 23:23:59 GMT","end":"Fri, 13 Mar 2026 23:23:58 GMT"},"fingerprint":{"sha1":"1D:B0:64:08:28:AD:11:61:08:C1:11:F5:88:B4:E5:20:99:53:FF:41","sha256":"8D:41:A2:79:DE:98:3C:FA:1D:EC:25:11:15:D4:1B:D2:61:C7:EF:EA:7B:20:7F:97:5F:90:F1:82:99:64:8A:6F"}}},"request":{"raw":"GET /api/getWebSiteConfig HTTP/1.1\r\nHost: admin.cetusexz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/x-www-form-urlencoded\r\nOrigin: https://ccetus.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\nset-cookie: php_exchange_session=MmSrNYXcyDgsLraKrEPD6Cz7ZjZ8d6U7YDFV0jpm; expires=Wed, 14 Jan 2026 16:53:40 GMT; Max-Age=7200; path=/; secure; httponly\nserver_name_session=38369494089f77565a6310bf101bd62a; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":170,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"f98d36f9fa40653095096f71de7f1928","sha1":"cdae34ccbe8ad138226b97a0d669919d7e5303af","sha256":"e9afefb95b4d0e8a2dd2059370ef3191012fab0bf639390c4bf519101fa66e51","sha512":"9f6ad7e53127eaccbb5cda4a8c0ff7b281de31deb211b869d8affd8d3b275454264e4ca2974b4362b62172afbd8f37b8967003fa793b58ad1504027883b76b8e","ssdeep":"","tlshash":"86c01212379a1d2007921ad6aa49b12c869161035058ea55c004de34c7758d01915c27","first_seen":"2026-01-14T14:54:04.35388Z","last_seen":"2026-01-14T14:54:04.35388Z","times_seen":1,"resource_available":false,"data":null}},"time_used":637,"timings":{"blocked":421,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/okx/home_five_color.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/okx/home_five_color.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474f-f70\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3952,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced","md5":"406a8484bd9f84e7a6e78a95ae8f7de9","sha1":"9d201eb15548d1acb1c65cb0ed8f6a9b1c52ea43","sha256":"bd63c7e776bab3f5152770a59c92828e5e07ea0a7ada74eeadb49a363ff6e298","sha512":"994ca6663fc706377b940a3c06987fa979fbb3cb70cced74b6509745e42e8f220bdc791e95a39f0b5534bed2ef4e90d5eb49160850af8119f6788f11fa7aafa4","ssdeep":"","tlshash":"e8817d5c91800a15000e8abe35aaf5074426aa8413eabf945efe830ec600d153c35dab","first_seen":"2025-08-30T13:19:17.538082Z","last_seen":"2026-05-24T23:31:20.579927Z","times_seen":3,"resource_available":false,"data":null}},"time_used":372,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":372,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.221.80.91","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.692Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:41 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Wed, 14 Jan 2026 15:53:41 GMT\r\ncache-control: max-age=3600\r\nset-cookie: __uni__uid=rBEQVWlnrfWQ85+8A6njAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-07-25T01:33:01.32396Z","times_seen":17462,"resource_available":false,"data":null}},"time_used":2105,"timings":{"blocked":929,"dns":271,"connect":244,"send":0,"wait":244,"receive":0,"ssl":414},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/favicon_b.ico","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:39.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/favicon_b.ico HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:39 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 18366\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-47be\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18366,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"49640b27e1ae0e7826a2642c3eb9ca96","sha1":"3b687b6362c5e0aa5e75ea908c6eef794cac45d2","sha256":"de422c48e79f0e99a416f9b967184976346bebfba660f24b41d97a4dbeb1ab1a","sha512":"9581e179484c4afe433b8d552825647bf780fa1e78205ae694245d4b1b682f91853156b2481a208ec1a3d9bac58cd44bb74e680d63b3ee1fbc8818b199c5a2d0","ssdeep":"384:SFUFB/aa4zOoC+qlITkLCezuRlF/CuGsFwvRq:SFcBya4zTC+qyT6Cug5GsGvRq","tlshash":"9582e0c0439878ed8daf10393a7f876d67b20e94c1ab55a5fb5c07168f6247a0bfc524","first_seen":"2025-06-29T23:14:50.473904Z","last_seen":"2026-01-14T14:54:04.356278Z","times_seen":2,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":198,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-follow-index~pages-follow-trader~pages-index-home_search~pages-market-search~pages-nft-artistD~29b73d58.13901a78.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.211Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/js/pages-follow-index~pages-follow-trader~pages-index-home_search~pages-market-search~pages-nft-artistD~29b73d58.13901a78.js HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-e959\"\r\nexpires: Thu, 15 Jan 2026 02:53:40 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":59737,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (59381), with no line terminators","md5":"125228f6a10ea4aca853b17d4a68677f","sha1":"9f6eb508dc6be937fa9518206f10d9445cd89b01","sha256":"71218383eafbd08bef0476ccba5fc825b9b847c093a38a6c2c043a5654a8b468","sha512":"18333610a9d1173cd318b12b71221191d0c75e37c217ae803b2aa20f6d47242acbacfbd50f0db0143882765dbd44a24fda591a3c3d654aca0571d238d453ef73","ssdeep":"192:w6uXDgAkhM4Hs6zJq1Bfo4R6eBl7gyWTg344mU3qKQ+hxMP1x8R00gA7isgO/G/N:K2ti+c4AaVX5P9pIKwg+k46ho56yAqa","tlshash":"b64329c2f5da30244167cbcdd151b2fc9abaab6302836cd2ea813f314f365d6652671e","first_seen":"2026-01-14T14:54:04.357671Z","last_seen":"2026-01-14T14:54:04.357671Z","times_seen":1,"resource_available":true,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/icon_bar_back_white.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.637Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/icon_bar_back_white.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 384\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-180\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":384,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced","md5":"fd5d5bc113d3506b7b0f8e630575d191","sha1":"c4c6afdda50077d0df594f87fb6e91f77c8a6b29","sha256":"fcfd31f8940717b12b8c3dca6700d312bbbc15b9816a7b316c774113adda1fb6","sha512":"4991427edfac755bc0094657a01bf0c434187c57b8184ed3b48f4b46c842d8e382da396a680a99ab24751dc2de5ffc7ecc7476133dea99ebeb1539e9236bb8ce","ssdeep":"","tlshash":"e3e0f1c267b7e9f2adec4478802fc903c032b338805646888036cc655c566f455a1c80","first_seen":"2025-08-30T13:19:17.485309Z","last_seen":"2026-05-24T23:31:20.622571Z","times_seen":3,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_my_home_novice_community.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_my_home_novice_community.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 934\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-3a6\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":934,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 57 x 72, 8-bit gray+alpha, non-interlaced","md5":"8e1fcfc8bc40fdf84bc54861762f39cf","sha1":"74fb4c3203737ca17454f7c82bc39ba0ef2abd56","sha256":"c97ac0f228dfc32dd118df283e110dff9d6d87dd5aa84bb2e4ff25f5f06c3f2c","sha512":"6acc5733154e839b0d93546e67fc5008b51b62f755219b25402cb4014738ffcfdf79609d82b7a43ea5a915fad5737ab112517a276fc1511c6cc5210e8af5e233","ssdeep":"","tlshash":"1111c8b255a824d8f098ccf41192e70ff5c0b632a170514350b660b619128159890f69","first_seen":"2025-08-30T13:19:17.529805Z","last_seen":"2026-05-24T23:31:20.637208Z","times_seen":3,"resource_available":false,"data":null}},"time_used":376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"admin.cetusexz.com/api/getHbList?type=3","fqdn":"admin.cetusexz.com","domain":"cetusexz.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:39.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"admin.cetusex.vip","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Dec 2025 23:23:59 GMT","end":"Fri, 13 Mar 2026 23:23:58 GMT"},"fingerprint":{"sha1":"1D:B0:64:08:28:AD:11:61:08:C1:11:F5:88:B4:E5:20:99:53:FF:41","sha256":"8D:41:A2:79:DE:98:3C:FA:1D:EC:25:11:15:D4:1B:D2:61:C7:EF:EA:7B:20:7F:97:5F:90:F1:82:99:64:8A:6F"}}},"request":{"raw":"GET /api/getHbList?type=3 HTTP/1.1\r\nHost: admin.cetusexz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/x-www-form-urlencoded\r\nOrigin: https://ccetus.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\nset-cookie: php_exchange_session=J96Mkc5yVm2lnAuyiI7xMI0cupDynmzTvSI2ORy0; expires=Wed, 14 Jan 2026 16:53:40 GMT; Max-Age=7200; path=/; secure; httponly\nserver_name_session=38369494089f77565a6310bf101bd62a; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3121,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a1e1aa27ac133f99df3ce388227e6c36","sha1":"7f470542afe6b56ca19dda5e41d7ab11db9c3a0f","sha256":"c9c1f6c92508e3d35896714ac117eab1a3221a5eb6bd1a107c6ba1eb573b6ca8","sha512":"93a412ac8d5f561f5d9a445e88479cd0b6fab97acf7f2b59e90a2d648370c26b5cf88f30aea4591b9ad289f1d47bba7f622baa579ebe58d1245f6ba9ee7f0325","ssdeep":"","tlshash":"13519c1ce6a25fe8c2f023c119d135bdf92e2246b9c11e85d7ed8edc8198315f196d32","first_seen":"2026-01-14T14:54:04.360408Z","last_seen":"2026-01-14T14:54:04.360408Z","times_seen":1,"resource_available":false,"data":null}},"time_used":980,"timings":{"blocked":373,"dns":3,"connect":181,"send":0,"wait":234,"receive":0,"ssl":186},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_my_home_spot.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.677Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_my_home_spot.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 926\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-39e\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":926,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced","md5":"31253a5c933c0a5d2fe3c5160e601868","sha1":"cfbe486fb016588cb1361f93c24d690e4e7c3022","sha256":"1c28ef4ec501a79d7ddfc66651cbf1f35fc191d8436a5464425433b96819706a","sha512":"51bea875017bc10baafe362f37284a72740820af5d32c805ac83d5c9aaa78cf291ce5ce98bb42a04d503756b73c8c5b5f25f2bae1042c61658199a8fcfc6399d","ssdeep":"","tlshash":"0e11c4f204c6d9ca01975df70a3af4206a9251b945cacb2ca2a8027fd10aaf88606322","first_seen":"2025-08-30T13:19:17.548943Z","last_seen":"2026-05-24T23:31:20.595608Z","times_seen":3,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":375,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_my_home_o.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_my_home_o.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 620\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-26c\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":620,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced","md5":"46afd17661ef03360d42ab74e24fcf5a","sha1":"86ce2f902d7ea626eb8e06e46f008a1f83159b91","sha256":"47d99cbb3ac9f61b8e6882f67593e7fb7200457b2d28681824f4229241bce183","sha512":"7875f9496aa4c7fcdadc05548e0d9e68dc4e9e0849f7a153ab273c6016943da580a9e737b1c56f32c9b5eea2c9854e93295e36e2f5514c6594654f5a4f893a75","ssdeep":"","tlshash":"d4f0629fcbba7e28421f4e6194c2a881d73340af010903293d601f1373a218085f9199","first_seen":"2025-08-30T13:19:17.502267Z","last_seen":"2026-05-24T23:31:20.611878Z","times_seen":3,"resource_available":false,"data":null}},"time_used":374,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":374,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_my_home_save_coin.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.679Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_my_home_save_coin.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 901\r\nlast-modified: Mon, 12 Jan 2026 00:58:55 GMT\r\netag: \"6964474f-385\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":901,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced","md5":"936361e05c351f9efc754c9cab274c06","sha1":"e487fdf6012437b501cf8875fe182c2a1bb6a930","sha256":"233823e1c15088c9231819f2762250b30c65e9835a4b02a7693934c20a4caf93","sha512":"fbf2f72a0bd76ef5406b92dcd70831c1727c8f1d0429df9efc860d7ee3b3bf4f84421babf5e63aecf8d58d4e58d3b7ade34cde6d25d5f2e2e2447683bb4e1fbf","ssdeep":"","tlshash":"6f11b7e2ec045e6b8c25297df549220dbf001ac52f9c40a5cd1bc88730379605dc7f43","first_seen":"2025-08-30T13:19:17.527877Z","last_seen":"2026-05-24T23:31:20.626766Z","times_seen":3,"resource_available":false,"data":null}},"time_used":380,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":374,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_my_home_dao.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.682Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_my_home_dao.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 731\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-2db\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":731,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced","md5":"b1b388a480b0f76dad08a44c9a9b31b2","sha1":"5032455a5dc0f7321c4711de8017e451290114f8","sha256":"f3f9ba49bc93b2892cdd254e4b61d1af6eaa16dfb47528c9913a971f618dab90","sha512":"4fa97440936377218a07d1b3104049c6308685914b710520ec9e0175bf4f4e3b945f49d18d6603fed43d5af6230f86a77a0a860837d32dbf95a1c6974b421458","ssdeep":"","tlshash":"c30165d0bb7e6835dd849beb5cbc295955021f7308024228cda9bd35c601bd8248c381","first_seen":"2025-08-30T13:19:17.552834Z","last_seen":"2026-05-24T23:31:20.587704Z","times_seen":3,"resource_available":false,"data":null}},"time_used":377,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":377,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_my_home_association.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.684Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_my_home_association.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 886\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-376\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":886,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced","md5":"545d14c6350a2005d5cf9ddb7bc88580","sha1":"d1cbfbbde8e4d97a55355e142e1700114262fcdb","sha256":"0615cead7951fbf5b5d14226ef615ca4f95e48c24734de2b4ad572da0bed5522","sha512":"7bb0a35351d93fa3526df177461767c14f2f1eff576f2cbfe4e0119abc49df148cd87bcfcd277f37fbaccaebc2a75b59838337af814a933f531779c5faa51378","ssdeep":"","tlshash":"8711b7c5bae1c86cc9c34607c1103022855b3e1961228315a85ec849ab273e0c4cf687","first_seen":"2025-08-30T13:19:17.544669Z","last_seen":"2026-05-24T23:31:20.630367Z","times_seen":3,"resource_available":false,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":375,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/chunk-vendors.73f64582.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:37.143Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/js/chunk-vendors.73f64582.js HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Jan 2026 00:58:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474d-1fdf78\"\r\nexpires: Thu, 15 Jan 2026 02:53:37 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2088824,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65527), with no line terminators","md5":"674505ee09fc38d42e2d3b79806692df","sha1":"efdc3328426c4a4d58b6388963bd80fec3b0acd2","sha256":"4de5f17a7d9b485356c5dd204c1139f6008cc35093d745328a8ea70c8e2260d9","sha512":"91596435cf1abb1cebde789529c42c42c53e7f197688178db44a11345c8c95e281fc802eb571afe5d2e14ae0bdf0b32dceccc6af9ee0e73c350bc40f2412a9f5","ssdeep":"6144:oKU5O5f8X0EQH1UNUIjIKHX2QS7S8LzQdExJo2kylx9cg/c:oKU5OZ9IjIwXyRzQdYkm0yc","tlshash":"722518d872d1f0a643d320b4003f210bb27b6928a84d9498f776d8e66d79d9e5237f39","first_seen":"2026-01-14T14:54:04.369134Z","last_seen":"2026-01-14T14:54:04.369134Z","times_seen":1,"resource_available":false,"data":null}},"time_used":590,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":590,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/js/pages-index-index.aeb63724.js","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:39.713Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/js/pages-index-index.aeb63724.js HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:39 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-1225b\"\r\nexpires: Thu, 15 Jan 2026 02:53:39 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74331,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65326), with no line terminators","md5":"925bbefa2e8fd8816a34226d36fe98ba","sha1":"5ab44f23b2a1097f3504bd5fd3f442e5a2b2f1e3","sha256":"0ead64b93bbb99b16d2a930c89812390f50974cf4788e30fe3d535df7785c6cf","sha512":"3fdefb8b6140e08b5a90543712daf22bc5d4f97f29bb329ea11c865453362036552907c25105da5ada2f956c72ae0d37f8f8e384e40544ea80184372f93b466b","ssdeep":"384:QOYajcF/eLshg4qWpEestkpzvfRq/yPtSqqRFtD/+KLhf1q:pcQXesqNR+yPtZqRFpNq","tlshash":"9f734ba3fdcc2214856bc719916122fcb53bea735283d9c3e4437fa46f1a5c66e0e918","first_seen":"2026-01-14T14:54:04.370028Z","last_seen":"2026-01-14T14:54:04.370028Z","times_seen":1,"resource_available":true,"data":null}},"time_used":200,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/DIN-Regular.ttf","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:39.729Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/DIN-Regular.ttf HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:39 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 24676\r\nlast-modified: Mon, 12 Jan 2026 00:58:53 GMT\r\netag: \"6964474d-6064\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24676,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 14 names, Macintosh","md5":"1e0b91dcb4ed262d0c603006919a1fd8","sha1":"aa0cecebc344f5a3bbd614ab97a42ff8f8637d46","sha256":"4749fb5068ba31c2cba31bf6c7340977fc21cf0e9339bdf155dd57457cfc9e0d","sha512":"dc5635a9a7a8f0b3b454de6c1cd56bd22d16310a18b874f153a38bdecaf41dad5eea2405f3e092d9040f9278d37cc5163dba32f3478f91d7a6a348f4ee708bd8","ssdeep":"384:9iJk3F9sakdL5E5P/y5QJ0FNpmuJqJgkJhBZ5JeJMz1vHJb90KILamCKwL/plOLz:9JmdlAn2/pm6cBpJX2sdX4","tlshash":"9db27c0957424b0fc7277e308e2642a2d725fcb427fa9bdb9d44d8f7606d2e34c68a45","first_seen":"2023-04-17T17:59:29Z","last_seen":"2026-07-23T15:53:23.470633Z","times_seen":526,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":198,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"admin.cetusexz.com/wss/","fqdn":"admin.cetusexz.com","domain":"cetusexz.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:39.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"admin.cetusex.vip","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Dec 2025 23:23:59 GMT","end":"Fri, 13 Mar 2026 23:23:58 GMT"},"fingerprint":{"sha1":"1D:B0:64:08:28:AD:11:61:08:C1:11:F5:88:B4:E5:20:99:53:FF:41","sha256":"8D:41:A2:79:DE:98:3C:FA:1D:EC:25:11:15:D4:1B:D2:61:C7:EF:EA:7B:20:7F:97:5F:90:F1:82:99:64:8A:6F"}}},"request":{"raw":"GET /wss/ HTTP/1.1\r\nHost: admin.cetusexz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://ccetus.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 9EnGexFCuByx596YMYcnxw==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx\r\nDate: Wed, 14 Jan 2026 14:53:40 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Accept: pUK0jkz86cBwV71vnzJhBcUUTtA=\r\nSet-Cookie: server_name_session=38369494089f77565a6310bf101bd62a; Max-Age=86400; httponly; path=/\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T02:51:48.557212Z","times_seen":17519369,"resource_available":true,"data":null}},"time_used":1698,"timings":{"blocked":-1,"dns":551,"connect":746,"send":0,"wait":197,"receive":0,"ssl":769},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/banner/banner1.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.022Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/banner/banner1.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:53 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474d-60217\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":393751,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 896 x 1056, 8-bit/color RGBA, non-interlaced","md5":"f1e950fde8251f3049fe5fc0a8d47fa5","sha1":"a6e84600f4c4b79b0714f087cd91bacb3ad71c20","sha256":"502b92afd49313213ff2e62945e64e9421408fa04d40a676a4c14f8da67d02e0","sha512":"184f9dcba5655a296995499dd842faae1b4558fb56bc485802fbfb586089b2ccf5a2b0f2336ce39c49a42db86fe36fdb610ecfdff1c48712905bb2b92bd38170","ssdeep":"6144:HJR/97lNZLBQ5BTw7kFk1LLQmbPgJFOJ+HejXbAldYn8JZ/i1KL0XO7:n/9JTLBQ5FqLcmbPge1AM8JZ/PYXo","tlshash":"288423c98d0dfc49574566fe36333b3b46382278b2352dc8b5ae81f2b2578d2598d0d8","first_seen":"2026-01-14T14:54:04.371858Z","last_seen":"2026-01-14T14:54:04.371858Z","times_seen":1,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":202,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/lang.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.657Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/lang.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:55 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474f-2ac8\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10952,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"3998295457e0c7511fda6e56a38c1ebe","sha1":"472a0a5d40a5d9c3a3b90c16c8972445ad181a9d","sha256":"168ce150567d8e29a61effbe7be72a35d362c7fdc46bd9a3c8db1384ec247920","sha512":"742278bdb0fcad578b50f92171e8af57ecd80fe81140e63c5f43aab5fdfd6140284cfa285dccf336dcb996d939bb596fbcd1420b25e54d2703df33802e44b239","ssdeep":"192:40KyjfMG5pcq13cxdR1E1561CKbuzyazNmTQbIjl6sULjpg68YVOAAN:5dUsPnvqhamTQsj+CjYsAAN","tlshash":"6232cfb51461ad334da242a00c33b36bdde9b57f7a50e54b51f6027285c94c70cb4f6d","first_seen":"2025-08-30T13:19:17.532947Z","last_seen":"2026-05-24T23:31:20.609232Z","times_seen":3,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/gonggao.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.662Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/gonggao.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-b30\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2864,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced","md5":"771cd84b00889dc60a4ef7797ac42c7c","sha1":"bc9fa8407a7d3525210195334fd26f4992b222c6","sha256":"315f9bf45bec76c1227137862c10fe81c5af63c5f5869b34189fac1f69ab4158","sha512":"eeba1f7731ce1b5e3e913933476c79f48b3a50896e74cf3f5424c15861665c57edf6816b2ee1d9137339306b72315f78624a949392b9a6e35590ea123e61ba3b","ssdeep":"","tlshash":"0f514b9e41f6b6fad9fcf932c948ff50a0ad2a14a6380766e705944a0c0d33cdd97648","first_seen":"2025-08-30T13:19:17.490628Z","last_seen":"2026-05-24T23:31:20.57451Z","times_seen":3,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/google_bind.jpg","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.674Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/google_bind.jpg HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-c1b7\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49591,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 795x800, components 3","md5":"c4ba16b6d8dca98dae3c9a579fef25d3","sha1":"2147213d8bbf505b776c53335b379443479034f2","sha256":"eafa036a67df98b9e595bd2209dc7f748fcf2f98d7b74e665d989d6d081af4c3","sha512":"914c8b091e62d1c6acc59fdcfd8bf8d5fdaa9ca1ec25aad75d98cac150125e44dd39d63475b4d379611b7d54a4bcbe696cdeecaab51cd0a8bcbdc82a544aabd6","ssdeep":"768:Zpkv8dmbl5Z4mm7SaQsnuRAtkM3R3RMZZLHIF9mZ1nTIRvI:Zp9mbFTRsnu6kMh3RYZLHIF9mZ1kRvI","tlshash":"af23e50799089f93981dd3e9bf071e882f17272ce8c539ee25161edb3f58762488c56e","first_seen":"2025-08-30T13:19:17.547483Z","last_seen":"2026-05-24T23:31:20.58207Z","times_seen":3,"resource_available":false,"data":null}},"time_used":373,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":373,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"admin.cetusexz.com/api/getHbFloatPriceList","fqdn":"admin.cetusexz.com","domain":"cetusexz.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:39.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"admin.cetusex.vip","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Dec 2025 23:23:59 GMT","end":"Fri, 13 Mar 2026 23:23:58 GMT"},"fingerprint":{"sha1":"1D:B0:64:08:28:AD:11:61:08:C1:11:F5:88:B4:E5:20:99:53:FF:41","sha256":"8D:41:A2:79:DE:98:3C:FA:1D:EC:25:11:15:D4:1B:D2:61:C7:EF:EA:7B:20:7F:97:5F:90:F1:82:99:64:8A:6F"}}},"request":{"raw":"GET /api/getHbFloatPriceList HTTP/1.1\r\nHost: admin.cetusexz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/x-www-form-urlencoded\r\nOrigin: https://ccetus.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\nset-cookie: php_exchange_session=WtGMHBRIWKqSDCrmvRiGgwGxGo72SdRAQiy5Sjjx; expires=Wed, 14 Jan 2026 16:53:40 GMT; Max-Age=7200; path=/; secure; httponly\nserver_name_session=38369494089f77565a6310bf101bd62a; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1207,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"bf03fb10e50fe39f8d6c023fa8b16978","sha1":"6748c7c1c28a4162e68003aea8b37ab06a677ceb","sha256":"751cf4a1f050ef143890562a57acc4a690034f21e2c3f54b36ec767951afad1c","sha512":"ccb2587271f35277493138c79246d3987c6c2400c035cff9f62ffd53c5b2175983a69ed808872b7741b1a4232e8d758cc270d31c9878838e863f700330e02509","ssdeep":"","tlshash":"c721cb417aac5e74d7b61a4449abba52219c314ebfc40f29d7ecce2a02f613a4b07516","first_seen":"2026-01-14T14:54:04.375058Z","last_seen":"2026-01-14T14:54:04.375058Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1064,"timings":{"blocked":426,"dns":54,"connect":180,"send":0,"wait":217,"receive":0,"ssl":184},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"admin.cetusexz.com/api/getHbList","fqdn":"admin.cetusexz.com","domain":"cetusexz.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:39.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"admin.cetusex.vip","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Dec 2025 23:23:59 GMT","end":"Fri, 13 Mar 2026 23:23:58 GMT"},"fingerprint":{"sha1":"1D:B0:64:08:28:AD:11:61:08:C1:11:F5:88:B4:E5:20:99:53:FF:41","sha256":"8D:41:A2:79:DE:98:3C:FA:1D:EC:25:11:15:D4:1B:D2:61:C7:EF:EA:7B:20:7F:97:5F:90:F1:82:99:64:8A:6F"}}},"request":{"raw":"GET /api/getHbList HTTP/1.1\r\nHost: admin.cetusexz.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\ncontent-type: application/x-www-form-urlencoded\r\nOrigin: https://ccetus.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ncontent-type: application/json\r\nvary: Accept-Encoding\r\naccess-control-allow-credentials: true\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: no-cache, private\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\nset-cookie: php_exchange_session=wk4kwLemYfrRKHF9fivrHDJVoVz0H6XesoPTy5N6; expires=Wed, 14 Jan 2026 16:53:40 GMT; Max-Age=7200; path=/; secure; httponly\nserver_name_session=38369494089f77565a6310bf101bd62a; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22368,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"9fb26d49b5d2d84e114129b52da7d6a3","sha1":"ec2eac8507af7ca2d1a9855656e7e36c742b0b33","sha256":"9aeede7b6dad5fbd02e8909a578a6f4a195fe6decf93f36666998a7e388ed6a4","sha512":"2ad42e77ce9fdb2cde86c3c2364585fa89574011722dca28e52379bf55735307ad0d94c0f9666ff97a6c0788fd98ca525dfa5fde4541892803d623710e4aa9a2","ssdeep":"384:c/BC8SiLT2xPjWL9PFmE1NgIcn+7TWh9UFdkqxpo0n6+OlAMMWrWy9RtuptADxy6:c/BC8SiLT2xbWpPFmE1NgIc+7TU9UFdi","tlshash":"a1a2b01ce6515ef8c2f166c10ac225bdf96e314bb9c11f45d7eece9c8298356f282932","first_seen":"2026-01-14T14:54:04.375813Z","last_seen":"2026-01-14T14:54:04.375813Z","times_seen":1,"resource_available":false,"data":null}},"time_used":866,"timings":{"blocked":220,"dns":0,"connect":0,"send":0,"wait":447,"receive":0,"ssl":199},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_home_message.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.665Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_home_message.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\ncontent-length: 413\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\netag: \"6964474e-19d\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":413,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 66 x 66, 8-bit gray+alpha, non-interlaced","md5":"8284b6d56661bfbad0f7994d4130b7e9","sha1":"270b90858b943f572e2ff0c398ff55c116ff5bef","sha256":"897c509f00887b0eb6763fc8229978f1e2f99221d13ad5f693218d436c677c05","sha512":"3af82ae6a9630b88a20818b5d6d28314edfa27531bd3286fa5f714a936b03dcf3d55251e7699ddf80a2cb1d23c3bbe292b1ffa36c03de3ad079794b470b4d37f","ssdeep":"","tlshash":"59e02bc48395ac3ec3d221c60f84aa88b898c8802b2da028201ce86e6c31884208c461","first_seen":"2025-06-20T02:35:28.047289Z","last_seen":"2026-06-25T01:18:10.539998Z","times_seen":76,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ccetus.com/static/bib/icon_telegram.png","fqdn":"ccetus.com","domain":"ccetus.com","tld":"com"},"ip":{"addr":"103.179.44.107","port":443,"asn":149020,"as":"WebHorizon Internet Services","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ccetus.com/","date":"2026-01-14T14:53:40.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cetusexm.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Wed, 14 Jan 2026 05:04:16 GMT","end":"Tue, 14 Apr 2026 05:04:15 GMT"},"fingerprint":{"sha1":"01:17:E6:16:9E:B1:53:23:F4:3F:92:6D:27:37:D2:98:DC:5E:EC:23","sha256":"C6:4D:85:54:1B:5A:EC:FC:6D:D2:5D:64:74:22:B4:5A:1D:75:4C:73:EE:04:DF:E0:D9:EE:13:DB:EA:CA:78:EF"}}},"request":{"raw":"GET /static/bib/icon_telegram.png HTTP/1.1\r\nHost: ccetus.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://ccetus.com/\r\nCookie: server_name_session=3987226ec17de982f787a74514ce5360\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 14:53:40 GMT\r\ncontent-type: image/png\r\nlast-modified: Mon, 12 Jan 2026 00:58:54 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6964474e-f76\"\r\nexpires: Fri, 13 Feb 2026 14:53:40 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3958,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"1635ec6c2851da45f15468d906633e04","sha1":"39f542eca0d02a2627f882c101d20ef4d4edffcd","sha256":"e9e5371daa6d0028e20b983a52c115c27552c9f9554a1bd4138debc92b67cb95","sha512":"1582793c997aa881e1c94efd0e27bef70ff781024cf52f7b9037329b36d81ea9aeeae46fc7487466d72efe49d01b47c7b1901258e4341f5fda67c7bf6283ace0","ssdeep":"","tlshash":"e8816dd34deab4567d3aa47f588f4d25c8a63b5834e3df21c2995cbcf122990b456c01","first_seen":"2025-08-30T13:19:17.519575Z","last_seen":"2026-05-24T23:31:20.552234Z","times_seen":3,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"ccetus.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}