{"report_id":"6224b9a8-a9b5-48cf-9a6b-4ecf71bb8ac6","version":6,"status":"done","tags":[],"date":"2025-11-14T12:05:14Z","url":{"schema":"http","addr":"1xlite-837593.top/en?tag=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":0,"asn":0,"as":"","country":"Iran","country_code":"IR"},"final":{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"title":"1xBet","dom":{"size":39,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"086707e4369f60afedcafb16050a7618","sha1":"8216b0cc6876cbd44f01c158e7dff3833ceccd41","sha256":"a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e","sha512":"aade21843813e2cab329b99185c6f61db7907a556ea974e0315dcf3ad967cab20fee66d4f10db0d0ec43a71e086ce6d700d5524103deaefa3ce5f6be74ba5737","ssdeep":"","tlshash":"6a9000fee0a2000efc303bc00cc2238a0c28c3a830028e002ac038b8c80822bcc032c8","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"1xlite-837593.top/en?tag=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":0,"asn":0,"as":"","country":"Iran","country_code":"IR"},"tags":null,"meta":null,"user":{"country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-19T12:05:14Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"v3.traincdn.com","ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"domain_registered":"2022-11-10","domain_rank":256434,"first_seen":"2022-11-25T10:00:40Z","last_seen":"2025-11-10T09:09:06.606307Z","alert_count":0,"request_count":66,"received_data":5918015,"sent_data":33113,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"1xlite-837593.top","ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"domain_registered":"2025-04-30","domain_rank":0,"first_seen":"2025-11-01T08:36:22.283822Z","last_seen":"2025-11-01T08:36:22.283823Z","alert_count":50,"request_count":17,"received_data":965238,"sent_data":43624,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"region1.analytics.google.com","ip":{"addr":"216.239.34.36","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"1997-09-15","domain_rank":22257,"first_seen":"2022-03-17T11:26:33Z","last_seen":"2025-11-09T22:14:25.349966Z","alert_count":0,"request_count":2,"received_data":1702,"sent_data":2087,"comment":"","tags":null,"fingerprints":null},{"fqdn":"radar.cedexis.com","ip":{"addr":"45.54.49.5","port":443,"asn":63911,"as":"NetActuate, Inc","country":"United States","country_code":"US"},"domain_registered":"2009-01-07","domain_rank":28156,"first_seen":"2013-11-27T02:31:43Z","last_seen":"2025-11-10T10:50:55.61872Z","alert_count":0,"request_count":2,"received_data":1415,"sent_data":850,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.google.no","ip":{"addr":"142.250.74.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2001-02-26","domain_rank":92680,"first_seen":"2012-06-26T23:22:08Z","last_seen":"2025-11-09T22:14:25.18694Z","alert_count":0,"request_count":1,"received_data":580,"sent_data":763,"comment":"","tags":null,"fingerprints":null},{"fqdn":"www.googletagmanager.com","ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2011-11-11","domain_rank":283,"first_seen":"2012-10-04T01:07:32Z","last_seen":"2025-11-09T22:13:41.73664Z","alert_count":0,"request_count":1,"received_data":509869,"sent_data":438,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"94361ed86ab9b2fbb8d805c2025df46a","sha1":"3f428332f7a1c7196a85c93a373a966d75708c19","sha256":"eee4d228a49a86625f29410cf9a23d145e821a09cbb1f7a4d7557d206872715a","sha512":"c8f4fb7c642357730c6c59e0b49fe3ec16c228d83d4ce402dc62f01e451529b8087240afca37096cebdaaabf47c189dfde5e6e2d780440f663f0e2bc8cf88ff7","ssdeep":"","tlshash":"f6b012df6c8351104a9292e001dec8f0443620303b00cc45544ce7716d2e865de2625e","size":96,"data":"","first_seen":"2023-12-06T14:32:27Z","last_seen":"2026-04-04T17:39:02.587331Z","times_seen":7916,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/Page.Block-93e7a560.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"4688921dd58bd12524ba60852e763123","sha1":"5c222365a788acc952948e8b2aa1587f4fde9920","sha256":"4f8d584258ec2d305f82a30c11816062d3710d638a3abafa3a81b569b9a64548","sha512":"ddbb8f616154fba47fb0c0f8816c1bcdb4ff080f301c792499231d257a840bda1041ac0540c1ef4cff92b835e50a0760787bff1a0c7c505ff159fff6333017ea","ssdeep":"","tlshash":"40f00e9b2462fc8e95e6008743bac1f7b48c797a0649682002a0c8b132b6826081128f","size":475,"data":"","first_seen":"2025-11-12T13:10:31.006041Z","last_seen":"2025-11-20T09:36:24.059026Z","times_seen":162,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"ed9ef0328757e2311c58625d16ed1642","sha1":"4cd4fc37173c94cd08832984a8bcb0f1718d6660","sha256":"93afd72870152eb05d69c023e685c7751e5f22e1663332ff5bc29b7d52c894a6","sha512":"4df3e0c215207d8304bceb72eafafa966507c8f7b4720d85dbc5f83423c2dfa409344b562a76e26c6090e12114e4092133d276b0eae81f72f9c1d0cd632826c9","ssdeep":"","tlshash":"9231455dfa1cf0360511b5fee03f634deb3318d56965b008c460a8996c74e4f541aece","size":1736,"data":"","first_seen":"2025-11-12T14:09:39.108955Z","last_seen":"2025-11-17T09:04:21.055382Z","times_seen":99,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"eval","is_inline":false,"md5":"66d773767d50c5b70a8449eccfd788f2","sha1":"e51c36d7e0758f8f7d7874727a82d137cdd59bbc","sha256":"28440bf7609c16d6a2267966b0ae086ed90c179a9df5b8536b69b4675218165b","sha512":"be3f5c9660fc624b091b493e06e3193441c964b0c2f2b37cf408cbd6dcef96548cd852549b41de6d6c413aa392f9ea12f60a65900a61c4c001703c9e6348b1d9","ssdeep":"96:7pv/gKrFuZtd3Am0H1qpt91eOn4R8xIhl:7pv/vkMH1c91e04eIhl","tlshash":"ca91f833502d7a7fc92a2a0f430f2f039978216236d16b4c796d0be8db656c97787287","size":4232,"data":"","first_seen":"2025-11-14T12:05:26.823136Z","last_seen":"2025-11-14T12:05:26.823136Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_popper_js_WZJKYEQD.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"bea5b052c307601192270938523fa030","sha1":"937f7094c67f5a92c1032a7bc3f21ee94bec66ef","sha256":"f41290374ba615854ebb4b28a07de775581707f3b6427bcc01c0529c62476f64","sha512":"b9bff7f7d9b518ec76898a732114873c01206378c2a840c62062f05487ef773716ce841d7a5bafe3f0c65fbfdf05509852571a3a6b381661cb6f4984d6bc23a9","ssdeep":"384:ZP7iayBuR9vu3z1JXvykd2+LaqHdC6RjVnTGm/7piCXmH8kCCcvJTCyCu+meAxiZ:piZwO3XvO+NMSJt3XmckXcv4nxJAxiH5","tlshash":"7b92a28c7684b0a287a7a2a7a07f860f71376865650e9004f59cf6ec3c35dba507bc7d","size":21252,"data":"","first_seen":"2025-08-22T10:11:14.555802Z","last_seen":"2026-03-04T04:00:43.408775Z","times_seen":3920,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/hd-api/external/assets/hdf.js","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"17cc4ade9ae4dd646178200428d67b62","sha1":"8949891455535a68218c809864ed91eb0f800c84","sha256":"b0c9aa9ea44642cc4d2a68a6a0ea81b2d8578aca18a4769c64f8b482189572c3","sha512":"ed1d64775d6f6aee5ac22448f6678a4742459eec3389d87d9383e7053ed5cf31cc74eb8ef0b3f3597b02e16f53d07bf88b2b7695c5f072cae01f7c2e48b00155","ssdeep":"","tlshash":"316182a764ae7e1212480cc7a47e9a4b7050e9063ca9f850d0bf6ccf2404da1c9a1f1b","size":3281,"data":"","first_seen":"2025-10-17T07:26:39.008746Z","last_seen":"2025-12-13T09:36:03.351895Z","times_seen":1800,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"a01893d8e129ad16c1e0fc5c7537f411","sha1":"0e46d1bf2718f848d9d596fa269eaedb31204772","sha256":"cbe7b89533bcd75b69f3e54807308551d68242ec1761e63bee1a99fc6e560175","sha512":"074e309b533fc11690afbeab9b4dda85851e086c0ede97936860c7a5c4120ed9a16c6ced4fffdad21ca322f6c6e51577bd4966c5264b4a9780495acc451aee65","ssdeep":"","tlshash":"0d9004f515405350c5533d54401f1d5400f105703c40cc71014cdcd10c710f0335d5dd","size":47,"data":"","first_seen":"2023-04-14T16:26:15Z","last_seen":"2026-04-04T18:12:14.729627Z","times_seen":12996,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/analytics-fe1636b1.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"73d4c420e89c558b4bc9c1744bd10140","sha1":"dd3301119f1c8f21d71d0a8b2a6ecbc15a3ea947","sha256":"c350ebedd3556010929ed821d9522bfeca5c92fa4877372285e78998723414e1","sha512":"c4f0581fffc08acd672d3da4aebe183a448683902315a6bdc96b064fb2dfa5a59143980d0a49cdfb58534d8a8122504a7cbf89fb9fc8dd3c8f40b1b341896f63","ssdeep":"192:8vOGjPZxnEW5+vXjV3VeA9qshuvWa9wHWJ3vQFtRnOMPQz77vO6Rx+qkJ/vO9O:IjPZxnEW52J3VeAcbvWa9wHWFQFHOMPJ","tlshash":"0312a78e7d88e83007ba19b8f67f9a0ae07657172406c051caf9d8843d7da8f511becd","size":9435,"data":"","first_seen":"2025-11-12T13:10:30.969619Z","last_seen":"2025-11-20T09:36:24.046621Z","times_seen":165,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"domTimer","is_inline":false,"md5":"01f4b51b4ba7edd00ad9f0a22259f06e","sha1":"00723d0eda4be61a7b1c542b0a08a94a94a60017","sha256":"9fdac1c31a22f55dbb8ca225ee28c3f7e88b41cce82968af0018c9f8b3bd35ba","sha512":"83d180c9960a53f88da3e3ff8616b4e095b7d642182f5855cfa386d48a19b888fedbde6433d1f926d9dd93d0a813a24590591729a6d8393543dfc490efee2070","ssdeep":"","tlshash":"29500000c000c0c0c000c03c0000000000003300c0c00030033000000c3000c0000003","size":10,"data":"","first_seen":"2024-09-21T15:04:59Z","last_seen":"2026-01-22T06:40:31.224966Z","times_seen":5888,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/7c83ee949a.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"ad3a3d2317f96322d0bd0bae414eca13","sha1":"4b367b3626f9536266d422a09e76afa1e22ac213","sha256":"bb82e2523b400ba9521030d95afc38171855fc725b4ff54098715e0e1260adfb","sha512":"79529a9be80ddac6562c5c75b07b9553bd10e578bcd9208b25737a4769dce65cbe766cb2cd936f81f97b38de9ee5cb7aa679c9e5bf94cec60fead2ae8806842c","ssdeep":"96:Fh2JzYFijJGhVsrTkr9M0kdaEwXqlZTsasW6FPYW2bxie92m3Um72FiAbjn:FhjgjJGhVsv89M0bXqDTsaJuPYWG99nM","tlshash":"95c1e9ad2af934fc256c0e9abe1654f186684c2623bcd4f6db4b0f600738015d666dc6","size":5601,"data":"","first_seen":"2025-11-12T14:09:39.074517Z","last_seen":"2025-11-20T10:41:57.60955Z","times_seen":166,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/2383c13e2d.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f85c1dc682c1717c34e0317143a2936","sha1":"0e6740b6019e4398f92a2ab5b8cfa8c749a57e36","sha256":"4c3fb17517b3f56d123be8634cd6ab5c679537018289740ef248fc515a991d5e","sha512":"95dda2162789364fee02e7cd064957653fc03eb8fb30c4cc40edecc816520ec853938443cb8878c8ba713b7d041dea1e0f6a405473c5d5d7dde20cf6cae17e9e","ssdeep":"","tlshash":"570141ff5fb290382685b8c82ecd756191c0acab0747a0a482cc11c2d3410145a4aaeb","size":812,"data":"","first_seen":"2025-11-12T14:09:39.054175Z","last_seen":"2025-11-20T10:41:57.636188Z","times_seen":166,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"7bcdb973ab8af8e24ab11cb554a1ba6e","sha1":"24e8a10f240f2b06f81d7c173cd0a90606641fc1","sha256":"916ec4eb9b485eb47f43a17fe212e84e4b72600b45eb6d4588599ad495a57fcd","sha512":"1d890761e2a00081531fda5c0489ebf4df4140a9748bdc6d97bd355023e3e4ab09e19663ab319cf775e28ba71d99ab09f20d5414a561fa10fa3be2cb874484ca","ssdeep":"","tlshash":"e380044710411010cdd351d040573c44001044f114c4dc500040fdd11c53030110545c","size":34,"data":"","first_seen":"2023-04-14T16:26:15Z","last_seen":"2026-04-04T18:12:14.72465Z","times_seen":13014,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"bc51ed8c76553717f10d58b2df60fd76","sha1":"e2d03a8fd8d280074b226c288880f9df299c7cb1","sha256":"bee994eaf88453f6343ba57571a069054c12c9b4e42f8cbad4f2ad75c7fb264c","sha512":"3207379b65060d0e80623fa966633b5ea31358b20de9aeb2c9416fa7d29f1972bf30809e39f0b826565e569d856dd2498ee0ec5285271c127f54daa7cf391911","ssdeep":"","tlshash":"489004473441140c47d7175410375c4c0c1500705441df400451dc510d51031114545c","size":39,"data":"","first_seen":"2023-04-14T16:26:15Z","last_seen":"2026-04-04T18:12:14.727446Z","times_seen":13007,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/vendors/app-efd67d7a.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"25d6eda502ccfab2b9cb920949ad873d","sha1":"b9a42a825e34ce132152eaed28bcf600c4f08438","sha256":"d7bb46de616b2461894991083c4cf1c8bcf9d5c5e957b75640be28d975a59975","sha512":"f2b0f9aece401adfa0adcc2a322191638cfb1d7d6fa9304a4c4b2194f647b7c4aa454ca9fd8ebc0126b99a479f332aede17da0156cd1876862468771e157cd07","ssdeep":"12288:LdQX/yYLwdkjexY4g1/SDlLioPu5VzYg3xWdep7D:eX/yY8dkjexY4g1/SX25usxW4p7D","tlshash":"56254b69b981f2560aa36ae9c06b0057e33d6f1eac0cd454f2e7cdd5395a804713bb2f","size":963291,"data":"","first_seen":"2025-11-12T13:10:30.963396Z","last_seen":"2025-11-20T09:36:24.065196Z","times_seen":167,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"45b737daba0cd47df954234a7badbdaf","sha1":"b4714361dba61e2505d6b0dd5f59e36cc82a3c5f","sha256":"cdded4401aaf9b423a5cee1f816d09ab131c27be32ddce1ff9bfbc7174801b56","sha512":"4e66c03b10c3e6339ab25bbe2185e07f84f9c483e6e863205838257a3a194c5fa0feb7db576a29db43f1d2491ace37e8fc41ebbafc60e15d9c26fcb9fddc6d75","ssdeep":"192:1gCr0vH3New6kDBv/vkhM3X1c91eJQtSbNg:xr0f3l6yv/vGM3l21es","tlshash":"a3f108a3d008fb6fcc66590ff16f1f210d50296935927b08e6fd87a83967270b347246","size":7717,"data":"","first_seen":"2025-11-14T12:05:26.829377Z","last_seen":"2025-11-14T12:05:26.829377Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":true,"md5":"4794badc36157ea40e7c5d472963336e","sha1":"088e83c43e8ab92120496771b73c473c32d65511","sha256":"227458411ca3ab6c3c47d9b88b75d6c9b642ed56f9a3991f2fd6394bd0948105","sha512":"b3e4603b570006aaad3b2988917e971dc19c90d8291055954cccd1e92d82b7d3dae5f1f14e7a9c94dc337a61d9463adb256410e0b9088df4c6b91a7d7c0c0d9f","ssdeep":"3072:T54F4iwGLeqJ1E5l00HH4iwZLeqJ1EenHR/98JDNDrWq7mKz:N4F2qw/fqxgDRxKKz","tlshash":"a624832faa0c0c3e911f1ab5c98f7e4e57bc5e1a20cb6d019cae6e2915e7794416343f","size":230039,"data":"","first_seen":"2025-11-14T12:05:26.832076Z","last_seen":"2025-11-14T12:05:26.832076Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/runtime-46fa722e.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"bffabc9fa21e6d2a3b9d2aacc6379aff","sha1":"f245ea3c087cf43d7967e078fb299d6f3aec46ee","sha256":"4125e905282c94bc6e2813bf93103e5f0504445081f330314ef982446175ca07","sha512":"6edd2c98238073b78560effbab2dd62a2b9c258b2b46f91f0f0296fb8a0d96ab5473d0838bbd76c0f3ace8c021b884f8c14c1b0629d7ba9a380aa43ab2342d9f","ssdeep":"384:WgoPESVItnw8nINgOEOESVItnwCVnJ20R7MYk1HULjt4:la5Itw8nINgOEO5Itw2nX9lk1H4jy","tlshash":"a7720f5daf1acd671d22ddc338217d21981824335c4647eceafed2194418ea866afe3f","size":16786,"data":"","first_seen":"2025-11-12T14:09:39.057602Z","last_seen":"2025-11-17T09:04:21.008234Z","times_seen":103,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/Betting.Core-c5b0991f.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"63f43bfef469b8ce0a6f76f5cb614033","sha1":"c971178f4479da3416d4f7b7bceef74ba911a9f6","sha256":"37823c6ad1f50d4ec96cf1ddff8d4e7efee14282f064b3bfd61321472b403b33","sha512":"8a114d70b964843e69b51765af44e0b2ab4c8909fb6e3b7305ad9e52a5049db2685868debf4a6f738e1a3fb1bf92385a5c73215d30f2aa101310d05a22fe4358","ssdeep":"","tlshash":"3a41d58a3ac174444b3e55d984f728b1f0a82da9398e00fca982dae071999d5c1f7ec7","size":2134,"data":"","first_seen":"2025-11-12T14:09:39.049317Z","last_seen":"2025-11-17T09:04:21.007151Z","times_seen":103,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_chunk_LNU73JEK.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"d96d317966512ab8915a90670ca5a5af","sha1":"a810be1c3e515adb49804e8d976250deb16fd77d","sha256":"f125201d62c452efba070d856821885c7cfd539a31d55846caa6ae3a7522d3cf","sha512":"460b29966e6f5ac4d34ccc714217d29686d7aff42efa92a102729d40aa36dd4fbb87116178b2f9fdece5fdb09cb2bf2024312d3f1b86abb69644f695c76aca2d","ssdeep":"","tlshash":"a521f1e56fbc7ba362be2ae4a02e0041e001d53752f4f1d4f294dfb4a4e949d035b5b6","size":1232,"data":"","first_seen":"2025-08-22T10:11:14.554562Z","last_seen":"2026-03-04T04:00:43.411503Z","times_seen":3921,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/Desktop/__shared_base-app_9052cca7f9.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"e24a49cb729e6ac7e6f75e60c8a251f1","sha1":"ff5cd9fca93f2d604468fd39250e62476c86bbfd","sha256":"6853a9fbaf9d4cf301644c94074e86115ae33d5321842e42bd7eff0bf09bfcd4","sha512":"35366c9beaa240db8e6f43492339d84d172314d88f82c3961465d8788c5accc9450e03c66c19fd70159788b64099cdb7db630e4596d2f963e7a0548a6e540f38","ssdeep":"49152:wtI6rPMUSQVFyNdcur6fK+XUif2A2bzWDYJY4deMU4:qlehP","tlshash":"d1759d55f156bd232ae754daa4271183b64c4a1dd408fc90f2ebdce83ace84162deb7c","size":1651303,"data":"","first_seen":"2025-11-12T12:36:43.186794Z","last_seen":"2025-11-20T10:41:57.659083Z","times_seen":218,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"radar.cedexis.com/1/23802/radar.js","fqdn":"radar.cedexis.com","domain":"cedexis.com","tld":"com"},"ip":{"addr":"45.54.49.5","port":443,"asn":63911,"as":"NetActuate, Inc","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"82dec77fd0353c7c71ce053b8601387e","sha1":"fbbca95419e1d0c042e0a5fdf10f380aca66188c","sha256":"39f2b7b0fa78d37d0c84d2d6618bd635d86fd683d9bcdd5729850cb2a62522f7","sha512":"6872c895cb44711405e57a436dfbe15d094f9159e11ee2b89983c63b1f18f6acbdfaf0ccbb5e48b2bf24f366f16584c660bca4b6b14c048a134bb77a60f6563e","ssdeep":"","tlshash":"02e068ae9391a318537a2dbacc4e060ba0f6114888e5e4e029f5c2c00461bae072bfb4","size":390,"data":"","first_seen":"2024-02-13T14:23:26Z","last_seen":"2026-01-15T12:01:08.184588Z","times_seen":7496,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/vendors/plugins.vue-js-modal-7c6b1456.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"67a9811aa20eae48b35d47488de2c8ea","sha1":"01aa906c57dfd795aae62a427082d392f05cfe51","sha256":"57f9fcfbe392708487e014b70a4298415511c54bc81910a1159767dc3beab9ab","sha512":"ae97056ac48bfa0d828abe5fed26dce3643472ad0adfd20cc86dd58633c19619789713cee8661c88b30b48f9eb8f35f236d62a51e483e9f2b60e924aae62a28d","ssdeep":"384:UBy0a9vOeCGAZIXfK2rVsAdm00uow4HQEjacGXGQVe6ubqQ:DHyIXfPt4wE9GXGQcbqQ","tlshash":"82c2288977d8307442db5563627f2b0ab23e295074269888f772e8e65cb864d206ff3c","size":26667,"data":"","first_seen":"2025-11-06T10:58:42.392801Z","last_seen":"2025-11-20T09:36:24.004712Z","times_seen":344,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/DC-bfe7727f.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"e240aa2b7ff14a3003f4a6843189ab6f","sha1":"1e41ba3e26e1a4f61230d02ab9cc36afa191182c","sha256":"3628a16803a7a09374ac72510704adc88d30ac65d0e11cdaec862cc61da9119e","sha512":"8dc37587cf244e27ef5e19682cd8059610e0dfeaf9485c14e1ad6dc3e063a99ee8f00ebffd826ae80f508bf7400b8f8d70cc75555ee2ca971810e7f8ee8d12dd","ssdeep":"","tlshash":"b241a40931a4fc11d3f90cd86dff7206102bf076648dc9b4d3a32a8b08b7f6aa217916","size":2201,"data":"","first_seen":"2025-11-06T10:58:42.372215Z","last_seen":"2025-11-20T09:36:24.066302Z","times_seen":344,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_fast_deep_equal_RNYYWXHZ.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"00e44cad05af09626c2b10aeee7de5a3","sha1":"4461fd05cdd85255f4ab24edd5ac80e7b6dec92e","sha256":"5277a86b8db312b1e34318cb994829e113d8204c3a2e88ab594e5135b2bbfb2a","sha512":"548bf615b1118881d21a0cfd2d530b3f0ce1e14cc93cb6afce662b30ac70877fa152fd71b5d786bb2e43e31a1980e00b83106b1f4b3ae12fbb2ddbedf6c81841","ssdeep":"","tlshash":"901159c232e3a0d183e058cd1001d906f23969e9a4bca0c9c757e6b93cb2a53d87672a","size":865,"data":"","first_seen":"2025-08-22T10:11:14.567955Z","last_seen":"2026-03-04T04:00:43.420123Z","times_seen":3921,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"eval","is_inline":false,"md5":"c5e01c20cb594d81ddcee96b24542548","sha1":"079a57f89b1071a149190487cff341be6ecd5cab","sha256":"7983281856a5ecbb535bf4fa5c0ac4e3a59efb8602b93a1437a38c6c4b82dda8","sha512":"c0165cbdeae93881cf667436909691be22716371844796d1779bfe82e18d23afa298195e1a882095fb8042a2e1079928e4e2438153fc5c6af3961b5d0ce2f936","ssdeep":"3072:/qMNiHp848vbmTnaf9klzpy/YPsu9z2U3F+NW0sjX5OTJgfgJxi59MOlyzypy759:4HpWvIWlhP5hhs5Ov5","tlshash":"a47493b92bd3f0d056cd8b25673fbc66b46a9c7964c8638d6017f618d8ad933e029c1c","size":348274,"data":"","first_seen":"2025-11-14T12:05:26.752493Z","last_seen":"2025-11-14T12:05:26.752493Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-5671CMJ6T4","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a86ff89b4b5adcf3d361d4ab3d3a16f0","sha1":"33886a593909165f799c4e89d52b56883b2e2fc0","sha256":"2efffc751bcc9ca21fd4c8b97465c58c466115fbc6022fae5d4faa16e68d6083","sha512":"ec1fed4cebc3d71673e0ea1db4ae222675b4d5134c5129931c35630f817cd624aa878f3bafaac29e57260cc5499e9a657762324a7844f39500bca902b7e2c8ef","ssdeep":"6144:9J4o7CyZOsjtxj34kbc2sUOJdR+rVmIQZtdSF3kkAi:Tn7ZZOytV5bhsmQZE","tlshash":"a7b4099f73c6742652daf468402f01cba97b24e2b45cc8aab1c9cdf02d7469b4167f78","size":509265,"data":"","first_seen":"2025-11-14T08:46:33.427527Z","last_seen":"2025-11-15T06:34:08.921876Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/app-0950f523.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"4e8159e169f65701671deaf5e9b0837a","sha1":"e89f1fc388d4289427c57f6d29dce6585339f148","sha256":"1eb367b9aba8a2af96a199695f8f46458b0fbd4058973b60acb54b307be1ec08","sha512":"f44d4842088e823320aa89a75428e442d388b7ca24ca264c2e204abcba375bf926fc7367de1b9ad2ad48e24a5f97835f93557eb0d0330156104d0a502f9f17e2","ssdeep":"6144:oLeU/mOhAn7sWt4cYsKZjhRx5YZZF91F/SIC+v6l3j3w3p+GZsQFaMJmHyX0AN30:I/mhLE+ZH4G0/W6fXztk4","tlshash":"93a44c65b5c8f4ca02e34bdae03a0161e33916b9780dd064f778fdca359bc05926a67f","size":458565,"data":"","first_seen":"2025-11-12T14:09:39.078732Z","last_seen":"2025-11-17T09:04:21.037271Z","times_seen":103,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/vendors/plugins.vue-notification-5b390c43.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"4b1ff7688640c01809e28779569b7ff5","sha1":"87ae5ac01471e3fbff903c1c7b419e003827d067","sha256":"5b15b063f36c4eabab028e4a6139680d508847b31968304172243614c710cd3d","sha512":"b0f2730c2b700899afb7fd513c0c9984f10553ea7e6c83d4600bd4c5b505351f2f1306840ec6072c779383ab0941b063ba3794c59494c19ac81069d86776dc99","ssdeep":"192:3U1hQXHv3CbfKpqEVwhSIkrReP+SdHtfGA2D3ow5EE9bJ52bFZLy2mp4ilVj:3n3CmpcDkAP+S/fGAWf5VbWbLy2mmijj","tlshash":"b04296ceb2c2b4650be760b6402f110af136a96869ab54d4f3b1d4f2adb564c413bf3d","size":12563,"data":"","first_seen":"2025-11-06T10:58:42.382403Z","last_seen":"2025-11-20T09:36:24.069268Z","times_seen":344,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"32053c9c355cf85427a5cc3f07de0b09","sha1":"f3c13d6a657ffa2ca8997f54f4779f0c02f1600a","sha256":"0ec410318f3ecc3a3aef3de68e99190845248bcc12282aa15eb9acc87f8837d3","sha512":"cbb8c7ef0bbed264989bf5b4af7d216cdeacc5684641c37d429e5ceca7dc04e55254e81f319cd856e7b4f447565bf5abf4e9915f5725eb57cfb142f113362078","ssdeep":"","tlshash":"2211756e18ed58291a9275c402b7ccfc642036363219d4c495ede9e1072ff990032f5c","size":1024,"data":"","first_seen":"2025-07-24T09:34:41.13762Z","last_seen":"2026-04-04T17:39:02.455144Z","times_seen":3851,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"256f3fc828311aa3c01f586df86a3b18","sha1":"128f5cdd267b22d34db84bd3de56dafa49c2de3a","sha256":"b2c2314f431f7a8c80c2f0bd24dd3d82036b3583e153b2d4ddf0f06398447c16","sha512":"c9cc1e493177e2a251a1a2f865355c7d1fc8d010da89553b8863e37c8a240958b43e0cb10391967102df17aac0eb3b879fea77686d5a3259ad094b03100f0264","ssdeep":"768:LFTStrl8kO6+xZsfwhmnnDHwlqxeI8zH+qij6RJMYlYWQzMh5pfv6jDfqtNjPTXO:wlnj+kf9JRyae1vRZSaMo5oPKu","tlshash":"0b8331d0289c59457faf84b9be6f42e2f50b9c7eaa940ac56436bf08247c1f59f84133","size":86337,"data":"","first_seen":"2025-11-04T13:30:50.175212Z","last_seen":"2025-12-11T09:33:36.701051Z","times_seen":971,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"580b3e56fc9ab6e8b4655f43ee057cc1","sha1":"5dfce565e446f4a167195de9a1a5dd26163c711c","sha256":"446f07b6e56de61d2c2d5b6ba408cc580b492a6d1ede8fc51cfde4ef75a2b382","sha512":"b2350579a3aaa5843b9b16c31782f3d7a4b850ba211d0074aa05d819c89ba49b482eb59aefcfb33f9fc9b270abb7cf7509e1254def23e9f98c116130c47f0018","ssdeep":"","tlshash":"e99002491d851041c56a1160041e1888442488761a40d8d1c480d9551c51630238e45c","size":47,"data":"","first_seen":"2023-04-14T16:26:15Z","last_seen":"2026-04-04T18:12:14.717194Z","times_seen":12999,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"data","addr":"data:text/javascript,export const meta = import.meta;","fqdn":"","domain":"","tld":""},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":false,"md5":"6d772b7d405b447ecee54ab61cdd5108","sha1":"dd65fb9cd5a7cb94a40fe161f4f72303a61eb3b7","sha256":"b90ff694e492935b6036fb7e878d365dab51aafa46f0afb1e33414e7ecc3307b","sha512":"a3947640368602c9fd9dee887bb1a7e463890ff42e2ddd292c377593c5fad246d3e3363e9898cd1e5ecda9c59b5cf7c7cd0acfc2a5a1e5d3acec2cf0d62e20b2","ssdeep":"","tlshash":"1f800003800802380aa0c880028e80b00ab222203f00c08328088b302e3b08aca332a2","size":32,"data":"","first_seen":"2023-12-06T14:32:28Z","last_seen":"2026-04-04T17:39:02.597072Z","times_seen":7915,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/vendors/plugins.v-tooltip-94e994cb.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"eb625cecc3515eeeed288a4a848a1370","sha1":"03983653e03d252b6c25c7ab181fcfc9627a015b","sha256":"59b3023a857b625069fc6ace89a0f1b1b8d1eea60418936a9f74d17f13b9bdb2","sha512":"352876c626d8c71a1440efa6e34f94ed31f4a49ff6813f9f27c87e719bc817fdd46fa1fc336851d9fd567080527199e93397a262e560ce516b39b8ad66700348","ssdeep":"768:xpVQJyG0t6uTbwLWMZI+7tSCUC8Lk7t8R6zk+BaNfSby/Qw/H/g57bh0PGBwrWdC:xpeJX0QuALTPRSCv1MHrWdRfm57EY","tlshash":"ad73b68e7394f0b203e7b175413f620fb2776558a40ae014b2b1e5d4ac3da5aa277e3d","size":76773,"data":"","first_seen":"2025-11-06T10:58:42.387819Z","last_seen":"2025-11-20T09:36:24.054652Z","times_seen":344,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_vue_deps_QPSMQ63M.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"111b97a8a36341794fc296cb6979d884","sha1":"9212f43c6d7643c8ccd5f20715a1a29b2c62d1f3","sha256":"7af238cd402218a59d817a1ff57ce4e9a123213b2d9b08ae97fd1d9575e82509","sha512":"f6e7d49683020ae21c09399f40dfe3a25c8a4654a96661294a0c0ebbdeb62cd8803ceb94cd8cfd25aae8acd4c6987f45633afd92d07b369e9cb423f40d5f49b4","ssdeep":"768:2AwZ1yyQBv4Hz+asCmaUOTfh5iwVwBo5Yy7Ys5CW0J7/FIs11O4:2AwWBv4Hz1sCmaUOTfdVco5YyUs5CW0N","tlshash":"bfe25cc8b779bca2335e908c90370313b37559e7584d9030f7a65ea231a564282e7f7e","size":31420,"data":"","first_seen":"2025-10-30T11:47:43.17512Z","last_seen":"2025-12-04T11:07:38.466417Z","times_seen":1062,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/entry-4b49c3fced.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5aa9f9fc6bb93ad900f72909bf07a0d","sha1":"d04de030247497c7b04a5f4b1463cdc70878cfa6","sha256":"cbf3f7809ef3032578c0a538d530198fd434bafcd6206bf9b6558b65416d0f5c","sha512":"1e9063df888908386122d507a259c5191930ea521b70a01d23c20fab19f9793a8c804dfb715ac7d9fe4f377f05b0df8dbd8fb0e616c1661693f54b3a6880cb7d","ssdeep":"384:H6FdIV9+owTqPl/MpUdinj1nW4Vp0z/F8/+Ls7zkNBHqAIuL5h+lH8WBHDCid7hQ:H6FKmo3PIUdinj1nWG+rG/+Ls7zkb5hx","tlshash":"efb26f747496b0b625da6a582639bc43d7c80f6fac9bfce2518b49e613c704c80527fb","size":23752,"data":"","first_seen":"2025-11-12T14:09:39.050553Z","last_seen":"2025-11-20T10:41:57.599077Z","times_seen":166,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_localforage_PJNUBKRP.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"7e7ebd44e3a6550f862e122ab7df6409","sha1":"384ecbc3ab0f65e6b0f88c1e68ba3eb73fad4999","sha256":"138767518a09e63d24f918f6380923893a2ec3aa59a640e51c83517501823076","sha512":"e2766b50e289dc6a69fa30432a49a0b7743f15cd15a54d707959c7623f258057a821a94285c492746216cfbf815089309b6cc09b930ba7977ff9c4ffc352d76e","ssdeep":"768:wDKAOpvMewHFuM96WwZACjzz46zSTKsBE1OvFXfX1UXk:wm8uPW43zEIOvdlUU","tlshash":"a5d2b68c7799f02683bb3070907f580ef237a912594d90a0e591e5f86dbd75c822bfad","size":30277,"data":"","first_seen":"2025-08-22T10:11:14.535778Z","last_seen":"2026-03-04T04:00:43.425133Z","times_seen":3921,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/b6acb55799.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"b9ab6ec44d87be362410f03d2ee0d6b9","sha1":"22fa4421d3aaf716bc315ee30caf1aa4870256b5","sha256":"79f0d616500808f0902080b83341d1f88ee74622d861da96ada967410ace0ffa","sha512":"ebd2416b256b72c117dc7daf94746ad2e04bb1e9fd0043fae0436c33f41d3e335e0c03c44d77cd92076e31e68a063de5828460054fbfa8a68bfa1822099d9dfe","ssdeep":"","tlshash":"0e617442ac74e6fafa1794143d1354a0d71f9c7ed1208ae8e2b4c8ec269c5926832e47","size":3359,"data":"","first_seen":"2025-11-13T15:27:51.591126Z","last_seen":"2025-11-20T10:41:57.653526Z","times_seen":142,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"2d7f92a0ec6dc3931ae0d33f534177bd","sha1":"95ad2e8783440b09442a6a3b7557d69dd6e9decd","sha256":"964875ad6215214835b366342797b353450ef0bb5de6ff0d03d2bfc2570cb1c2","sha512":"0a897f04d033239138bac193d4cda7b33eadd535d1ab1778aa4cab529eda5fd3e33157fe53638bc815f3156b2a39a7a300074103a70dbd765304d5df014917f1","ssdeep":"3072:GYeKcJMyIanPdWyRtviNK3DCpskZxq2rDknWaszf1oJnQ7qHh2ZFiW3GhwDUR5TE:fLoP0IR3dj5ZgggqOD","tlshash":"a26493781be3b0e096de8375672fbc56b46adc7964c42389a017f658d8ed933e029c1c","size":335233,"data":"","first_seen":"2025-11-14T12:05:26.84059Z","last_seen":"2025-11-14T12:05:26.84059Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/main-static/88f30c11/check-ob.js","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"c065700c9c8c493403359e1f2baa10d9","sha1":"4630fe729e70bdf63fa7ba6c84ec277fd1f51030","sha256":"1e61f0c82ae82ffcf503fcd4b4c8ae27b32c11e19b882d5d13f3c44364c893f4","sha512":"b2e1c73cb94f5e3ceb35c3662bf4d72baf800a9a7c64318b1db07d50e9c885dbd94821ef3b3916d1b8b4fabb8f45cb588834b41c6a8a7f4d2c3e9c3866083ee7","ssdeep":"","tlshash":"96d0a79fb900211406939267d12f8668807724973f008182500597e069b8f4c4b37895","size":219,"data":"","first_seen":"2024-07-17T14:33:52Z","last_seen":"2026-01-22T06:40:31.153166Z","times_seen":6298,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/commons/app-287b92ba.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"scriptElement","is_inline":false,"md5":"665bc1cda6f82ccccc233fe2a9e02f7d","sha1":"9cb94dc519d41700a0ab70250bcc4ca9d7192f02","sha256":"20d42f3f8d7575dcdbba48d461ea454ab417e0899ac6c023ca3c8d0376fe32ef","sha512":"05c75328cb74cfd64b369ce8059a64f95625657b06f287802df4d0c7150642b4193abd73dffca6dd1a68ae8177f5af14b7151e5416d6832caeab3c202cff8dda","ssdeep":"1536:XCrmhSG5YGf7BMr3y6MPC0UiXH2DHJjIAG3wvvjE+gjmZVBQ+PWKYfaRtp:KmjYGNMrmXHUp0qXjE+gjmZtNRP","tlshash":"2fd3d5dcf695b03117e721b5407f150bf23a7898680ac0a4f266e8d53db888ea167f7d","size":137774,"data":"","first_seen":"2025-11-06T10:58:42.41009Z","last_seen":"2025-11-20T09:36:24.031528Z","times_seen":344,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/7af4a4ed2e.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"8a75e2a7f5e98518b7ec241719c1c690","sha1":"ad88a9521cd3cb9950eb8e8ab0bc9f0eb49b9f23","sha256":"2bfb13772b5a7074e2b8aba022bcdae4e2cb67a17522e3a807bbc7e7b5733fde","sha512":"80422eeba487ce9210c21b81b7694d9026bc88c8b55065be75a2ff085794ba4588990902dbc4fd59f359c338d4d06f97e46422f2d030beabe822c790b879a32d","ssdeep":"","tlshash":"3741c8d6b2b035f3e677516dbc0660f1c3182a9d132e10e4e9e9484e220c9c32767793","size":1970,"data":"","first_seen":"2025-11-12T14:09:39.054948Z","last_seen":"2025-11-20T10:41:57.594364Z","times_seen":166,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"Function","is_inline":false,"md5":"00beb9884d0391b342eadd30744b539a","sha1":"3124c0bd593822379d22f13d3e08e70a1bf5ea14","sha256":"92394eec5690449a4f6cfc9a7f97497a69e926b2365cb9a9aad3507a844f835c","sha512":"6fa2e21df54ca406f570cb639529d68edac5de27fd4bc3a9daa8fd0465b583ede1c1cabb550237deb75d8bf88f39e80c1a77777d794826ad3272630108e58661","ssdeep":"","tlshash":"539002492940210685661152001e5c58411491b094906c9140429c551d52020125ab5d","size":44,"data":"","first_seen":"2023-04-14T16:26:15Z","last_seen":"2026-04-04T18:12:14.737036Z","times_seen":13005,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/$_$.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"2cdaa92927f02e0b628f1ef4d7dd8caf","sha1":"9104a2e16ed080b80a42588b8aeb52ebec47ab7a","sha256":"ef8101ffea52addcdcfcc3a83f96ff2d4613fb3ae6d1c16bbe4852387b73a9db","sha512":"31da80bc1b17aa708fef74b0211af91fce1b4a5f518f11e5caa80f50e9a7791b6e94924e381f550fc44a02f4c1d785e5b95fa2464e7968b5cab079612d70d839","ssdeep":"","tlshash":"1ba002935a5ef66c209044860696e74733823d6a3477b1d625bc5509e6061474817257","size":69,"data":"","first_seen":"2025-05-14T05:06:37.199299Z","last_seen":"2026-03-18T19:40:26.76398Z","times_seen":5502,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_accept_language_parser_LEQ4UAP5.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"83e311eb8e222d229b6177bd007ce9eb","sha1":"96b851ffda0eab794c2bb637255a48ae25770144","sha256":"d0ff62de588e1c47eedbd91a89dcf394e2ec5bd09392ea556b9a34108077e9ad","sha512":"fd2e1bfb6588598e356ddc08724c2e6f602b89626b30eeca2c25b8f60340f25e28a761b8e13b75d1627172530abf7dd0e586e792f53759d08bda626145f65b0d","ssdeep":"","tlshash":"202112debed2b5908394188c4e2ec055f23a2957641ce6fcd765e7827c403a186f3c1d","size":1297,"data":"","first_seen":"2025-08-22T10:11:14.559442Z","last_seen":"2026-03-04T04:00:43.42063Z","times_seen":3921,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/5fa576b302.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"introduction_type":"importedModule","is_inline":false,"md5":"8bef143b1a40291055ba9511b0e5bf42","sha1":"5f4f50ddb6c59c51d71de57769b6e8db7d729754","sha256":"bd785da9def2b0cd40e1a9eb2c97ae8a09d6a72477a98371ba7c6fc1653914de","sha512":"3484f59803d2cb15c70a3eb3f670ace59e7f8b5c1d91d66d384bbe169400c117fad8af401b5f7847c36d0a58dc5bff6f52a18e6590fa1accf15cee039e47128b","ssdeep":"","tlshash":"180110a930b29188a5eb49cebd24103ad7781a42370a5cf5f7dd86b3509a18255ab886","size":737,"data":"","first_seen":"2025-11-12T13:10:30.968774Z","last_seen":"2025-11-20T10:41:57.623285Z","times_seen":168,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/captcha-api/assets/hunt-captcha.js","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"introduction_type":"scriptElement","is_inline":false,"md5":"99138712bc505690b0578f31bc82a540","sha1":"d580727b84630a468e5a7d2f49bf3daefa21caec","sha256":"b4ba8465ec038c66e61fd44d2c38bbcb4d0580db6be4b04c1479dc938952a719","sha512":"2df3bf3f99136219b514bf0d04ee81703eef14f2fb8be3e1e652c8078d4e43cfff7bbc54f8041ce3d3b2a39d166eb02a6a199295abce152218ee71876b1aed2f","ssdeep":"768:gtpmtrL3IN6RwCc15kf4hLenrXpklqxe64zHID+ijA1JeklYAczsP5pfvyjDfCtr:FL326RXc4fg0lHSUOND37CSt5w3CT","tlshash":"ce831ec4289ca6457bab4869be7f4de5f50b9c7eaa940ac55436ff08203c1f59f88133","size":88211,"data":"","first_seen":"2025-11-04T13:30:50.137692Z","last_seen":"2025-12-11T09:33:36.666737Z","times_seen":972,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null},"http":[{"url":{"schema":"https","addr":"v3.traincdn.com/version.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.198Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /version.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: application/json\r\ncontent-length: 11\r\ntraceparent: 00-51ec8e340a258713ed006c0a7ba92468-ea7d54a99e109bff-01\r\nlast-modified: Thu, 13 Nov 2025 12:35:18 GMT\r\netag: \"754d71cb136bbc5735da8416266438ac\"\r\nx-amz-meta-mtime: 1763037318.061964568\r\nexpires: Thu, 13 Nov 2025 12:37:59 GMT\r\ncache-control: max-age=60\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 25\r\ncache: HIT\r\nx-cached-since: 2025-11-14T12:04:26+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11,"size_decoded":0,"mime_type":"application/json","magic":"ASCII text","md5":"754d71cb136bbc5735da8416266438ac","sha1":"c5faab151f013cc378e0505934cb9d76332b61e6","sha256":"df84d33b922d421b254c89b6b87ea87c74bb2f2d80de5f572dd824bcd45b20a6","sha512":"17a81beec9d6deed92055f3e3231fc746c1538237e5159c49d4071b36e3e3d4bbedf05a135acb5916d514e0fdaafc274896e3c3b99a313e8e0c267267d4640eb","ssdeep":"","tlshash":"0a5000c3000c0000003c00000303c300000cc30c0000000c00f0cc0030000000000000","first_seen":"2025-11-13T12:36:46.901843Z","last_seen":"2025-11-17T09:04:21.01085Z","times_seen":101,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":25,"dns":1,"connect":2,"send":0,"wait":3,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_reset_password/en/dictionary_612c6e919ca15d39cc751a619a3952c7.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.081Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/web-app-v2/dictionary2/v3_reset_password/en/dictionary_612c6e919ca15d39cc751a619a3952c7.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: 765\r\ntraceparent: 00-25ceae8a53eb08f1a353d1017d58a534-8a8f70db8b27d0e5-01\r\nlast-modified: Wed, 11 Oct 2023 12:52:53 GMT\r\netag: \"00f980f23f1b4c1ccee99ed49e0a8feb\"\r\ncache-control: max-age=3600\r\nexpires: Thu, 16 Jan 2025 10:53:47 GMT\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2098\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:29:54+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":765,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"00f980f23f1b4c1ccee99ed49e0a8feb","sha1":"4cb07094de9bffff1bf81d94446280b91013b660","sha256":"bb3be3377fbb8e66a4b5a8a3866dfd865a37cb4a96482ab2f439981e03b57cea","sha512":"45587feec47804731eb344682dd7465959a50f2f47e114e332e875097a9e2009d6fe41e8ff684fb287d935fd9c4d12a5b83e1fe310f3ceca6061d569502ac1de","ssdeep":"","tlshash":"80015701129f0ef21b4bc65a940b1c71b2a0c043936b8c8757baeb8f73bbd8b009584f","first_seen":"2023-09-28T10:29:17Z","last_seen":"2026-04-04T17:39:02.413801Z","times_seen":5046,"resource_available":false,"data":null}},"time_used":4,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-1103/desktop/media_asset/d6fdd444d97e077c0b2d3a3de32a3097.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.096Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-1103/desktop/media_asset/d6fdd444d97e077c0b2d3a3de32a3097.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 182\r\ntraceparent: 00-3483a9e19883a5820cc071caba43948a-3397429b03f5cc51-01\r\nlast-modified: Thu, 27 Feb 2025 08:56:25 GMT\r\netag: \"0a64a07e9a34e8a5b5e97e80a10888c5\"\r\nexpires: Sun, 09 Nov 2025 21:47:07 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\ncache: REVALIDATED\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":182,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"0a64a07e9a34e8a5b5e97e80a10888c5","sha1":"82545cbc39b7dcc031dd10dea841a0b3698243d6","sha256":"7201497e7e8cdf9d35bf6998e43dcde5feea535f9828ce3ee98785781016126c","sha512":"fd619b94af18c7082a4f18556f1443081c8dc650b263c49c56f2514184d4f62e253ad87a220baa9396d7a06bc9ec3cc8ec75eee829a6c1016c4a3af2c1afa5ae","ssdeep":"","tlshash":"f0c02220e5f88823012b68bc80eaa55417504b2339021c20374c0a884b6162400149b8","first_seen":"2025-02-27T19:55:38.982186Z","last_seen":"2026-03-31T06:06:31.551304Z","times_seen":4136,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:00.332Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /hd-api/external/apps/c5e31d5915661de4393e3f1489b00ebc4497dd48/api.js HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/en/block\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1280; che_g=22b78b6c-0d92-4b18-a655-a4392ed48553; SESSION=13033e2b8d7c5d02143e1c584c11d481\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:00 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 615\r\ncache-control: public, max-age=300\r\ncontent-encoding: gzip\r\netag: 32053c9c355cf85427a5cc3f07de0b09\r\nvary: Accept-Encoding\r\nx-dt: 1103\r\nx-request-guid: ddfde2f441334b3fb87174f49d00107e\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.102, wf-uht;dur=0.024\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1024,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1023)","md5":"32053c9c355cf85427a5cc3f07de0b09","sha1":"f3c13d6a657ffa2ca8997f54f4779f0c02f1600a","sha256":"0ec410318f3ecc3a3aef3de68e99190845248bcc12282aa15eb9acc87f8837d3","sha512":"cbb8c7ef0bbed264989bf5b4af7d216cdeacc5684641c37d429e5ceca7dc04e55254e81f319cd856e7b4f447565bf5abf4e9915f5725eb57cfb142f113362078","ssdeep":"","tlshash":"2211756e18ed58291a9275c402b7ccfc642036363219d4c495ede9e1072ff990032f5c","first_seen":"2025-07-24T09:34:41.13762Z","last_seen":"2026-04-04T17:39:02.455144Z","times_seen":3851,"resource_available":true,"data":null}},"time_used":51,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:01.049Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2 HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:01 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 63748\r\ntraceparent: 00-d7760a209046401ae0281eb110ad92d2-7586d3f01bcc67af-01\r\nlast-modified: Wed, 14 Jun 2023 09:49:53 GMT\r\netag: \"6887b6f24414dbc612dbf42ccdc76b70\"\r\nexpires: Thu, 16 Jan 2025 10:32:14 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 642\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:54:19+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63748,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 63748, version 1.0","md5":"6887b6f24414dbc612dbf42ccdc76b70","sha1":"8068d3abfbc6cbf35b55919da45b1f4d2d136238","sha256":"fc5c015fc32518f1ed810fa84ca28941eb9d5a3c81acc8df69a4dbbeedef7b0c","sha512":"00f08f9dd648972c9571547e06172d5505dd13f577fe2e65a497d3856172807ac11c996984e4138d2eb2ac784257fe61864aee15752fe9e9e76f98db931e0c2a","ssdeep":"1536:KtdCG+Dz6RxAx457zL0ASEn091Y0H1mTOzI/OzMFOoTX4u:MMG+yRpzN091Y0VtI/pOoTt","tlshash":"8b5302485551fae2cac3073c0f7a89dbb37a776d519224cd98b69f830d37964bea2070","first_seen":"2023-06-14T19:15:49Z","last_seen":"2026-04-04T17:39:02.503075Z","times_seen":10298,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:01.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2 HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:01 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 63920\r\ntraceparent: 00-6473c6d8c21212740fca80702eb1ce2a-1cca50ad480870b4-01\r\nlast-modified: Wed, 14 Jun 2023 09:49:53 GMT\r\netag: \"a65527fcb58f66a7cfbc0e6b160538b4\"\r\nexpires: Sun, 10 Aug 2025 19:21:26 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 3358\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:09:03+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63920,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 63920, version 1.0","md5":"a65527fcb58f66a7cfbc0e6b160538b4","sha1":"45d260e7fa343401b5bb0df982a014f53e2d253b","sha256":"fb13c3a1cbac60649b76f7d7f85c1645d35ac69b85ce5f4eb0692505ecc2cd45","sha512":"8448e96abe326f43285b2d8b0d75beaf0e9c9e051e8754841d907b30eb303ae24c447011306da6a1703b9192d02aeff76a4517bdf94ec6e7dc360ce3538802af","ssdeep":"1536:UIG3hJMkJeK8ic5iZGnJ4URj9vqXOQ6UqYdbuA5RVK1:UL31hcLlRjDQ6Uq4W1","tlshash":"7f5302df8de32a148ff78772668885f4f4927c68898c8e7345526a8907f07d6b96c04f","first_seen":"2023-05-07T18:04:27Z","last_seen":"2026-04-04T17:39:02.424617Z","times_seen":10176,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":6,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/Desktop/__shared_base-app_9052cca7f9.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.306Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/shared-assets/Desktop/__shared_base-app_9052cca7f9.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-fa645f6a3678548600bafbcd7e71e120-8819359f733be6e8-01\r\nlast-modified: Fri, 14 Nov 2025 09:33:45 GMT\r\netag: W/\"e24a49cb729e6ac7e6f75e60c8a251f1\"\r\nx-amz-meta-mtime: 1763112745.841755303\r\ncontent-encoding: gzip\r\nexpires: Sat, 15 Nov 2025 11:17:03 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2869\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:17:03+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1651303,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (23760)","md5":"49ee1032b79106c1aef7230d7d471d80","sha1":"c43f16c11fd5c7b81054e5f16dde96b9ad008bf1","sha256":"82eaa04a96b6db9e55bdc82f54c44cd4ded6c239576136f18cdc8ab4078b5d93","sha512":"8469cf4981246b530a5b45c3d7fac0bc3bbb1cba93176dd7761cfa344669e9d6e4696e728bdc1e2c6cf9c826736ef1a6d6d1edc499ee27b5fcb400cfbf473136","ssdeep":"24576:wtI6rPMUSQVFyNcMlcur6fK+XUif2A2bzWwRgYJYI:wtI6rPMUSQVFyNdcur6fK+XUif2A2bz9","tlshash":"43259e65f1127a1326e759d9a4671187b65c4a1dd80cec80f2ebcde83ade41022eef7c","first_seen":"2025-11-12T12:36:43.149765Z","last_seen":"2025-11-20T10:41:57.609069Z","times_seen":218,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_chunk_LNU73JEK.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/shared-assets/__shared_chunk_LNU73JEK.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-0009c8f371fa52594000ca1d6eb0ec82-aa3606a74e8cff1d-01\r\nlast-modified: Fri, 14 Nov 2025 07:59:03 GMT\r\netag: W/\"d96d317966512ab8915a90670ca5a5af\"\r\nx-amz-meta-mtime: 1763107046.881269843\r\ncontent-encoding: gzip\r\nexpires: Sat, 15 Nov 2025 09:40:32 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 8660\r\ncache: HIT\r\nx-cached-since: 2025-11-14T09:40:32+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1232,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1231)","md5":"d96d317966512ab8915a90670ca5a5af","sha1":"a810be1c3e515adb49804e8d976250deb16fd77d","sha256":"f125201d62c452efba070d856821885c7cfd539a31d55846caa6ae3a7522d3cf","sha512":"460b29966e6f5ac4d34ccc714217d29686d7aff42efa92a102729d40aa36dd4fbb87116178b2f9fdece5fdb09cb2bf2024312d3f1b86abb69644f695c76aca2d","ssdeep":"","tlshash":"a521f1e56fbc7ba362be2ae4a02e0041e001d53752f4f1d4f294dfb4a4e949d035b5b6","first_seen":"2025-08-22T10:11:14.554562Z","last_seen":"2026-03-04T04:00:43.411503Z","times_seen":3921,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:01.645Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2 HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:01 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 63920\r\ntraceparent: 00-3765c13ae19bd6bb099bd0f6de02adc4-38219f17ec1a1795-01\r\nlast-modified: Wed, 14 Jun 2023 09:49:53 GMT\r\netag: \"a65527fcb58f66a7cfbc0e6b160538b4\"\r\nexpires: Sun, 10 Aug 2025 19:21:26 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 3358\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:09:03+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":63920,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 63920, version 1.0","md5":"a65527fcb58f66a7cfbc0e6b160538b4","sha1":"45d260e7fa343401b5bb0df982a014f53e2d253b","sha256":"fb13c3a1cbac60649b76f7d7f85c1645d35ac69b85ce5f4eb0692505ecc2cd45","sha512":"8448e96abe326f43285b2d8b0d75beaf0e9c9e051e8754841d907b30eb303ae24c447011306da6a1703b9192d02aeff76a4517bdf94ec6e7dc360ce3538802af","ssdeep":"1536:UIG3hJMkJeK8ic5iZGnJ4URj9vqXOQ6UqYdbuA5RVK1:UL31hcLlRjDQ6Uq4W1","tlshash":"7f5302df8de32a148ff78772668885f4f4927c68898c8e7345526a8907f07d6b96c04f","first_seen":"2023-05-07T18:04:27Z","last_seen":"2026-04-04T17:39:02.424617Z","times_seen":10176,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/desktop/media_asset/e6baed4eecf4ba7f9a5c2fcf97aad110.webp","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"imageset","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.188Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/desktop/media_asset/e6baed4eecf4ba7f9a5c2fcf97aad110.webp HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6642\r\ntraceparent: 00-a14eb1909b0ba801c0a33d821974f754-0a38917c04f9dbb7-01\r\nlast-modified: Tue, 28 Oct 2025 08:17:54 GMT\r\netag: \"f2a90faef41c53fb4af747c8cbf25485\"\r\nexpires: Thu, 13 Nov 2025 15:59:53 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.046\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 3350\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:09:01+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6642,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 960x278, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f2a90faef41c53fb4af747c8cbf25485","sha1":"54855a9fb307c4ecc9afea135838328cf439162e","sha256":"993540582d4cab4dc40ba13392f7460f30f0b656ff1e413abe9c20387000cc92","sha512":"c6f5e9a6238a864affd37952ba241b4e5a01dbfad9a18e22b53ea00e6f3acbbf114a5752f0b5faecd89efa6d24990df365113d7321543d0d44cfab1987f123a8","ssdeep":"96:MdOd7t6i+bJODeMN38LbY5gZQpRDH/ij1TgpEV6iuRjxNY4wos4RWNFCjMzlAm92:MduSOXsv6DfiR8fisNk9X3qUhpg","tlshash":"d7d1b074a2c81a958a299e763e763dab6e81039c31bcb6d674b5d5c8c50843fede7030","first_seen":"2025-11-13T15:27:51.525317Z","last_seen":"2026-04-04T17:37:53.418064Z","times_seen":1110,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":29,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/vendors/plugins.vue-js-modal-7c6b1456.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.024Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/vendors/plugins.vue-js-modal-7c6b1456.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-c6e114faf85fc310350c95dfa8b0a7f7-60c35f5d15489b44-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:01 GMT\r\netag: W/\"67a9811aa20eae48b35d47488de2c8ea\"\r\nx-amz-meta-mtime: 1762953359.767534222\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:32 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81267\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:30:25+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26667,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (26667), with no line terminators","md5":"67a9811aa20eae48b35d47488de2c8ea","sha1":"01aa906c57dfd795aae62a427082d392f05cfe51","sha256":"57f9fcfbe392708487e014b70a4298415511c54bc81910a1159767dc3beab9ab","sha512":"ae97056ac48bfa0d828abe5fed26dce3643472ad0adfd20cc86dd58633c19619789713cee8661c88b30b48f9eb8f35f236d62a51e483e9f2b60e924aae62a28d","ssdeep":"384:UBy0a9vOeCGAZIXfK2rVsAdm00uow4HQEjacGXGQVe6ubqQ:DHyIXfPt4wE9GXGQcbqQ","tlshash":"82c2288977d8307442db5563627f2b0ab23e295074269888f772e8e65cb864d206ff3c","first_seen":"2025-11-06T10:58:42.392801Z","last_seen":"2025-11-20T09:36:24.004712Z","times_seen":344,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-1103/desktop/media_asset/50995fc2d0c6966078299fee46cec63c.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.094Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-1103/desktop/media_asset/50995fc2d0c6966078299fee46cec63c.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ntraceparent: 00-912eb210c788ebaf7a7a7829f6a109b4-d07d201cc0274748-01\r\nlast-modified: Thu, 27 Feb 2025 09:05:02 GMT\r\netag: W/\"811ce3b7877d19901e45430cb6523d62\"\r\ncontent-encoding: gzip\r\nexpires: Sun, 09 Nov 2025 21:47:07 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\ncache: REVALIDATED\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14232,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"811ce3b7877d19901e45430cb6523d62","sha1":"16a905115a678fdef3923f91c6f76cbab613e84d","sha256":"10fbb74dbac63abfe9c4f5a77abc03757ef3527a479d4ae70dc977b515eec8cb","sha512":"21a43d793bd4200ff9972a793442fe492b6a1699f20053c4f01695f69f918685bf30f03f778346c2f61bac40d2e51bb25360d0ffc15448200c666ab4edf38e65","ssdeep":"96:BDkGHVTSY15XWGsQfGJo/JamRKkmP9kDeD3LzwCyi8TunZh:bVTS1KXR9RKkekDGoCyXOD","tlshash":"59523d65f6f40c33113b98ae65f76a8953948f07aa6d7c293b9c2b4c1f1462e0076d3e","first_seen":"2025-02-27T19:55:39.119779Z","last_seen":"2026-01-05T12:50:32.841809Z","times_seen":4543,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_accept_language_parser_LEQ4UAP5.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/shared-assets/__shared_accept_language_parser_LEQ4UAP5.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-af541af439cc2712aba1274170131f0c-21dde3bf4c95ddee-01\r\nlast-modified: Fri, 14 Nov 2025 07:59:03 GMT\r\netag: W/\"83e311eb8e222d229b6177bd007ce9eb\"\r\nx-amz-meta-mtime: 1763107046.881269843\r\ncontent-encoding: gzip\r\nexpires: Sat, 15 Nov 2025 09:40:32 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 8660\r\ncache: HIT\r\nx-cached-since: 2025-11-14T09:40:32+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1297,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1265)","md5":"83e311eb8e222d229b6177bd007ce9eb","sha1":"96b851ffda0eab794c2bb637255a48ae25770144","sha256":"d0ff62de588e1c47eedbd91a89dcf394e2ec5bd09392ea556b9a34108077e9ad","sha512":"fd2e1bfb6588598e356ddc08724c2e6f602b89626b30eeca2c25b8f60340f25e28a761b8e13b75d1627172530abf7dd0e586e792f53759d08bda626145f65b0d","ssdeep":"","tlshash":"202112debed2b5908394188c4e2ec055f23a2957641ce6fcd765e7827c403a186f3c1d","first_seen":"2025-08-22T10:11:14.559442Z","last_seen":"2026-03-04T04:00:43.42063Z","times_seen":3921,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/hd-api/external/019a8241-2b9a-7227-b47b-905cec202c8e.js","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:00.453Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /hd-api/external/019a8241-2b9a-7227-b47b-905cec202c8e.js HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1280; che_g=22b78b6c-0d92-4b18-a655-a4392ed48553; SESSION=13033e2b8d7c5d02143e1c584c11d481\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:00 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 101738\r\ncache-control: private, max-age=0, must-revalidate\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-dt: 1103\r\nx-hd-trace-id: DwdJhlc2pK0WW9b1/DIN7l+kk1zI9GfG503RX5S9/MyZDTRav69HhjMMDn6+wRjKv2wjd9NX6vwrrTzClTIi3qQakqWNZwLPK3Ju8oY3+sE3UvJUFUdbKcTo3gTWgLrm2qU7Gl2nuOTXwPiPqfX73H0uDHrbIXg7j+3GX/wKr2ZC9eoF4iXD7wn5TUITayRG1IQ=\r\nx-request-guid: 1f3b5745cbc34af586d4786293f49ec6\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.134, wf-uht;dur=0.028\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":348274,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"c5e01c20cb594d81ddcee96b24542548","sha1":"079a57f89b1071a149190487cff341be6ecd5cab","sha256":"7983281856a5ecbb535bf4fa5c0ac4e3a59efb8602b93a1437a38c6c4b82dda8","sha512":"c0165cbdeae93881cf667436909691be22716371844796d1779bfe82e18d23afa298195e1a882095fb8042a2e1079928e4e2438153fc5c6af3961b5d0ce2f936","ssdeep":"3072:/qMNiHp848vbmTnaf9klzpy/YPsu9z2U3F+NW0sjX5OTJgfgJxi59MOlyzypy759:4HpWvIWlhP5hhs5Ov5","tlshash":"a47493b92bd3f0d056cd8b25673fbc66b46a9c7964c8638d6017f618d8ad933e029c1c","first_seen":"2025-11-14T12:05:26.752493Z","last_seen":"2025-11-14T12:05:26.752493Z","times_seen":1,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.137Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\nContent-Type: application/json\r\nX-Lang: en\r\nX-Uuid: c859b9ae-2f21-4c2d-9754-c161720a7554\r\nContent-Length: 48\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; postback_watcher=; auid=U5Pgn2kXGuJg9yU4AwNKAg==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 23\r\nx-dt: 1103\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.125, wf-uht;dur=0.013\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"521ce29de3e598442aeedb82d0a7b2a6","sha1":"373afd7f5520ddef2d5fd109e51f6219e73feae6","sha256":"f24c31b0ab1511da582536861b50d0b63fb66fdc63e0be7cd6d805b2fee061b9","sha512":"4152e82171b767a35d05225e51f489ce7e9e079a1dd2bab7afbf3a1a968b8255197b2f0bc1849f44b1fbcc913a36ad519a73df52aa3b1dd58cdd0bca5bc907d3","ssdeep":"","tlshash":"93700088000e80c00e0880000280a8000e30a0020828882200c0c2020820cf28a0e003","first_seen":"2025-11-14T12:05:26.755548Z","last_seen":"2025-11-14T12:05:26.755548Z","times_seen":1,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/Betting.Core-c5b0991f.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/Betting.Core-c5b0991f.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-7f42ab98394632d5e9f0456ee2ceab2f-baf4ab86a36d0b7c-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:00 GMT\r\netag: W/\"63f43bfef469b8ce0a6f76f5cb614033\"\r\nx-amz-meta-mtime: 1762953359.7285341\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:33 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.001\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81267\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:30:25+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2134,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2134), with no line terminators","md5":"63f43bfef469b8ce0a6f76f5cb614033","sha1":"c971178f4479da3416d4f7b7bceef74ba911a9f6","sha256":"37823c6ad1f50d4ec96cf1ddff8d4e7efee14282f064b3bfd61321472b403b33","sha512":"8a114d70b964843e69b51765af44e0b2ab4c8909fb6e3b7305ad9e52a5049db2685868debf4a6f738e1a3fb1bf92385a5c73215d30f2aa101310d05a22fe4358","ssdeep":"","tlshash":"3a41d58a3ac174444b3e55d984f728b1f0a82da9398e00fca982dae071999d5c1f7ec7","first_seen":"2025-11-12T14:09:39.049317Z","last_seen":"2025-11-17T09:04:21.007151Z","times_seen":103,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/entry-4b49c3fced.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.276Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/sys-technical-pages-app-static/Desktop/Default/entry-4b49c3fced.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-ac3911f87bf13570f0f7a5bbdde5773a-3654fea892c03db2-01\r\nlast-modified: Wed, 12 Nov 2025 14:02:13 GMT\r\netag: W/\"d5aa9f9fc6bb93ad900f72909bf07a0d\"\r\nx-amz-meta-mtime: 1762956023.842274332\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 14:06:14 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 78901\r\ncache: HIT\r\nx-cached-since: 2025-11-13T14:09:51+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23752,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (23299)","md5":"d5aa9f9fc6bb93ad900f72909bf07a0d","sha1":"d04de030247497c7b04a5f4b1463cdc70878cfa6","sha256":"cbf3f7809ef3032578c0a538d530198fd434bafcd6206bf9b6558b65416d0f5c","sha512":"1e9063df888908386122d507a259c5191930ea521b70a01d23c20fab19f9793a8c804dfb715ac7d9fe4f377f05b0df8dbd8fb0e616c1661693f54b3a6880cb7d","ssdeep":"384:H6FdIV9+owTqPl/MpUdinj1nW4Vp0z/F8/+Ls7zkNBHqAIuL5h+lH8WBHDCid7hQ:H6FKmo3PIUdinj1nWG+rG/+Ls7zkb5hx","tlshash":"efb26f747496b0b625da6a582639bc43d7c80f6fac9bfce2518b49e613c704c80527fb","first_seen":"2025-11-12T14:09:39.050553Z","last_seen":"2025-11-20T10:41:57.599077Z","times_seen":166,"resource_available":true,"data":null}},"time_used":3,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-ui/3.3.490/Desktop/Default/merged.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-ui/3.3.490/Desktop/Default/merged.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css; charset=utf-8\r\ntraceparent: 00-8acef3bed2644ae48850a6a18ecfcf61-e816062b6819253e-01\r\nlast-modified: Wed, 12 Nov 2025 12:15:37 GMT\r\netag: W/\"17a0b557fb3dbf44ecd30503e6f37c5a\"\r\nx-amz-meta-mtime: 1762949709.361379504\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 12:22:40 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 85176\r\ncache: HIT\r\nx-cached-since: 2025-11-13T12:25:15+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":813465,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"17a0b557fb3dbf44ecd30503e6f37c5a","sha1":"3ea9e0ffa867a8a2d9c136f2a4e66281903891f4","sha256":"2400e74a348c3584a15630d7824a3cdda898c110321238bec18d20ab7fb03043","sha512":"a794ec5cd7bc5c280c070ecfbfab800ffe2e7d6cb4a0b0065f57a55ce4583ded6e3c3d2dfeaf93e56d1cf5c8aa9b11c7a6dec114634d5020eacccc2071f5eae3","ssdeep":"6144:41qYZGVX4t4ePBJmjbcooJhfN3MpIv+qrOWaUaHK2:Dw9N1aUaHK2","tlshash":"8705731cf29e91383e37e52562945ffc6620b7079b231c6ff859028a0ec395371a6da7","first_seen":"2025-11-12T09:49:22.160545Z","last_seen":"2025-11-14T12:05:26.761124Z","times_seen":60,"resource_available":false,"data":null}},"time_used":474,"timings":{"blocked":228,"dns":1,"connect":4,"send":0,"wait":1,"receive":0,"ssl":233},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/Desktop/__shared_606e2cb5e7.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.177Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/shared-assets/Desktop/__shared_606e2cb5e7.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css; charset=utf-8\r\ntraceparent: 00-23b568367e4bc214ef8f798ac1572123-94c4605424452449-01\r\nlast-modified: Fri, 14 Nov 2025 09:33:45 GMT\r\netag: W/\"1dc8748005533b71e8691e2b9d68ff78\"\r\nx-amz-meta-mtime: 1763112745.845755267\r\ncontent-encoding: gzip\r\nexpires: Sat, 15 Nov 2025 11:40:15 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 1142\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:45:49+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4522,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (4521)","md5":"1dc8748005533b71e8691e2b9d68ff78","sha1":"4797c50d0bda43bbfc820837e1487cfee79c73cd","sha256":"8ca778f0aef26c01e8df0e3b3cc9b231ec913cff7319a9949a8c71f597348832","sha512":"4f099e404a2c18d8c47171a0e2fff20bde10c44b88882967657fc37a46d6b39bc0f8053e371d53642bf85677e921fd598ec0b14e9663fe6c9d7d6f7e32781388","ssdeep":"96:y0EbBQ77VHY+R5f4wj5JeEaiq4vupNFZFZLiG:obBQ77VHY+R5f4wXQzZLiG","tlshash":"6a91408eecf6c03a8e27b812125c8d3d0735fd96dd211c8ef68c876614c3b9600d0eaa","first_seen":"2025-10-30T11:47:43.235075Z","last_seen":"2025-12-03T10:36:47.194785Z","times_seen":1080,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":49,"dns":1,"connect":4,"send":0,"wait":1,"receive":0,"ssl":45},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/metadata.json","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.004Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/metadata.json HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\nContent-Type: application/json\r\nX-Lang: en\r\nX-Uuid: c859b9ae-2f21-4c2d-9754-c161720a7554\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; postback_watcher=; auid=U5Pgn2kXGuJg9yU4AwNKAg==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 42\r\nx-dt: 1103\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.154, wf-uht;dur=0.011\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"6fe7e514a69fe773a6d85e2f9851571e","sha1":"e33289a86a719d1b99ab2000b39c877242be37d4","sha256":"d7793e501f5ebe81d431ff1065d09cff968be68d047922783549448b67c48fa2","sha512":"adcffa15ed33aec8dae64c6016d124e919e854f41ee0768d1be0c53bfbc82b95b674584aac7cb034f77614422690cbc3cab4353c0cb8380d59576dea3f6597d6","ssdeep":"","tlshash":"60900404405d05f45104410043c55d450f7c171311c0544570c455051351cf1151d003","first_seen":"2025-11-14T12:05:26.763021Z","last_seen":"2025-11-14T12:05:26.763021Z","times_seen":1,"resource_available":false,"data":null}},"time_used":40,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":38,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_coupon/en/dictionary_c26b86e79b8178c6775fa04a004ea27a.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.055Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/web-app-v2/dictionary2/v3_coupon/en/dictionary_c26b86e79b8178c6775fa04a004ea27a.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ntraceparent: 00-da8d4e54d824e52e5a6b989f2557be49-427f79e1e31ef5c4-01\r\nlast-modified: Thu, 13 Nov 2025 18:08:26 GMT\r\netag: W/\"dab33a12a5ff906d73784bbcb3e90c2d\"\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 19:27:19 GMT\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2026\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:31:06+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29194,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (28546), with no line terminators","md5":"7fb7d7e97f3dc4179916bbb33f757b46","sha1":"e342a495d047f7082d58a5d997615a26fe76b443","sha256":"99b8ae1cc63253be05a1ca8ae3b336c0554b0a6a71a2426e8e1e43563f410ca9","sha512":"1dec23be14f78f1ed9a54690e6684d5ac7eaf44fbe53b29ed748c85efb2b5192a24708fa9b9725e10da5013b5c9f97e97bbc2e9ea14d3efacdd34cbdd4c19792","ssdeep":"384:52q4J/8i+GZCH6CqyXLbhU8QnBehejpjfsE6oCNRbWxBGgVInt5DQHirGqT:Uq4JKeVjIoLug4t5DQ+zT","tlshash":"cbd2623eb403fcbbf58600c5ae6bbda361b80058d3a9ce1b98db481e21e75de5157847","first_seen":"2025-11-13T19:57:14.521074Z","last_seen":"2025-11-26T13:23:30.900548Z","times_seen":381,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-1103/desktop/media_asset/b4637c024b17ee3296bfff04fcbeba04.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-1103/desktop/media_asset/b4637c024b17ee3296bfff04fcbeba04.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ntraceparent: 00-4d67fba9facb7386f9619bbe3f89af4e-1895bab9374b78ec-01\r\nlast-modified: Fri, 07 Nov 2025 11:34:29 GMT\r\netag: W/\"b95bbe824df0e2a2d571358c25c01f88\"\r\ncontent-encoding: gzip\r\nexpires: Sun, 09 Nov 2025 21:47:07 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\ncache: REVALIDATED\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7723,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b95bbe824df0e2a2d571358c25c01f88","sha1":"7fcd8150dae9d36bae064f605676517894eba563","sha256":"deaedaa5a68d9f5a85961164003477eb5078602f7634eeb6257a45c235bd5234","sha512":"cd1211517c82f9675fb88706595ae2445566de27564f475ac7a26c3fcf67ee70f59ec575a5153c737c49bf87a75db9a1216d672dadbd146ffbd22e95ca8c3e00","ssdeep":"48:TzABBABGkABjABFygABCN/ABCNYN8ABWHABaEABzzEFABIIX4ABBxSHsABYiwABp:lFbClXCL3cblP+XyLO5GIQ","tlshash":"0ff11684fff05c33112f94ad98b37a89a3884f07a95a7d1c7f9d294c1f1451a04aadbe","first_seen":"2025-11-07T13:07:42.245146Z","last_seen":"2026-01-05T09:11:08.877922Z","times_seen":824,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/main-static/88f30c11/check-ob.js","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /main-static/88f30c11/check-ob.js HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/en/block\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; postback_watcher=; auid=U5Pgn2kXGuJg9yU4AwNKAg==\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 219\r\nlast-modified: Wed, 12 Nov 2025 13:20:44 GMT\r\netag: \"c065700c9c8c493403359e1f2baa10d9\"\r\nx-amz-meta-mtime: 1762953643.874296109\r\nexpires: Sat, 15 Nov 2025 12:04:51 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: wf-uht;dur=0.011\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":219,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"c065700c9c8c493403359e1f2baa10d9","sha1":"4630fe729e70bdf63fa7ba6c84ec277fd1f51030","sha256":"1e61f0c82ae82ffcf503fcd4b4c8ae27b32c11e19b882d5d13f3c44364c893f4","sha512":"b2e1c73cb94f5e3ceb35c3662bf4d72baf800a9a7c64318b1db07d50e9c885dbd94821ef3b3916d1b8b4fabb8f45cb588834b41c6a8a7f4d2c3e9c3866083ee7","ssdeep":"","tlshash":"96d0a79fb900211406939267d12f8668807724973f008182500597e069b8f4c4b37895","first_seen":"2024-07-17T14:33:52Z","last_seen":"2026-01-22T06:40:31.153166Z","times_seen":6298,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/e27425a6cf.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/sys-technical-pages-app-static/Desktop/Default/e27425a6cf.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css; charset=utf-8\r\ntraceparent: 00-87abaf5f7c71ea3fb44ea31f5aeb488c-2d36a7704cfd06e7-01\r\nlast-modified: Wed, 12 Nov 2025 14:02:13 GMT\r\netag: W/\"544ea803a3df8e55e85706a646f95614\"\r\nx-amz-meta-mtime: 1762956023.842274332\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 14:06:22 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.001\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 78941\r\ncache: HIT\r\nx-cached-since: 2025-11-13T14:09:10+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2867,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (2866)","md5":"544ea803a3df8e55e85706a646f95614","sha1":"ae409064324337a44a066208ec8fa7166bbfd628","sha256":"8991a0d7246dce731aee299bf16a3acbf1f59d5f36776c27e8cfcb7e77b3732e","sha512":"bc0360c2cfce28bc29b49404fe3e3230546cb7b7aebea9936246d7e99f78ac7a66b5143adea22a527739ba10799d93f73cde16c0363961b1b1632e39ddb5e6a7","ssdeep":"","tlshash":"c0516adef8b9d5752d33f022d70c5eb95930b527c5214e82f48c93a125c3a922aa1dae","first_seen":"2025-11-12T14:09:39.097866Z","last_seen":"2026-02-06T09:24:24.17097Z","times_seen":1064,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":34,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_forgot_password/en/dictionary_776c0b6a6ae43ea4503f983fa859981a.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.080Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/web-app-v2/dictionary2/v3_forgot_password/en/dictionary_776c0b6a6ae43ea4503f983fa859981a.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ntraceparent: 00-8542a7ca25db278594a786e87ae0ae09-8d59000178e81c77-01\r\nlast-modified: Thu, 26 Jun 2025 16:06:49 GMT\r\netag: W/\"9e075dc2a068d12162e260d49c92f233\"\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nexpires: Thu, 26 Jun 2025 17:12:47 GMT\r\nx-time-ng: 0.001\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 559\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:55:33+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4086,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"9e075dc2a068d12162e260d49c92f233","sha1":"9c748240ee9aeeb922f9998005c557517763a979","sha256":"81b3796da635e227e36b1a44c3224d8e0ccda902293beb08f84d870ed3bcee99","sha512":"6572c0bd8d55d4edc9ff8f263ef021d454593330e2f09759a2a26153870083e1d2cc308575d01196919d60a86170bd6b24436163427692b99eed38d0643eac9e","ssdeep":"","tlshash":"13819e0959831ef21abf8e90705e88663be5d06bde1764140fb5c30f3377e93668284a","first_seen":"2025-06-26T22:02:08.124583Z","last_seen":"2025-12-10T17:51:01.422955Z","times_seen":3966,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-1103/desktop/media_asset/ae15aad65f8743d781c08c5af00df54d.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.102Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-1103/desktop/media_asset/ae15aad65f8743d781c08c5af00df54d.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 747\r\ntraceparent: 00-a66990f84771ab5e2c0e1011ccba78a6-9f7df8face15e612-01\r\nlast-modified: Thu, 27 Feb 2025 13:27:35 GMT\r\netag: \"f4e90636ec9cff061c4301b3cefdd0d6\"\r\nexpires: Thu, 13 Nov 2025 14:15:24 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\ncache: REVALIDATED\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":747,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"f4e90636ec9cff061c4301b3cefdd0d6","sha1":"c506efe9c3672c58434ea10021dab0ad81b1ad98","sha256":"30666f138ccc12735e2f8a6405ddce4a3d8756b9445e3b2732fa2970f14dbcea","sha512":"2db1a1a4419db47b4256906f9c660b85479bb83d2ab0757d1b1c24cdf94d97bdc4a7140d5d8ea31cbf612a77ba1ae6ef46bbd77eb42d24b6d83afebbc46c9216","ssdeep":"","tlshash":"2a012d94bde4083719374ca981a2595d63844b0398297c087adf3d4c5b2096d056e9be","first_seen":"2025-03-01T06:06:39.041672Z","last_seen":"2025-12-04T11:53:51.978889Z","times_seen":4943,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/$_$.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.301Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/sys-technical-pages-app-static/Desktop/Default/$_$.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 69\r\ntraceparent: 00-9a1df13abcad9d7ae6d1b4685fe1a7e8-28038e2530878106-01\r\nlast-modified: Wed, 12 Nov 2025 14:02:14 GMT\r\netag: \"2cdaa92927f02e0b628f1ef4d7dd8caf\"\r\nx-amz-meta-mtime: 1762956023.836273719\r\nexpires: Fri, 14 Nov 2025 11:17:02 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2635\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:20:57+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"ASCII text, with no line terminators","md5":"2cdaa92927f02e0b628f1ef4d7dd8caf","sha1":"9104a2e16ed080b80a42588b8aeb52ebec47ab7a","sha256":"ef8101ffea52addcdcfcc3a83f96ff2d4613fb3ae6d1c16bbe4852387b73a9db","sha512":"31da80bc1b17aa708fef74b0211af91fce1b4a5f518f11e5caa80f50e9a7791b6e94924e381f550fc44a02f4c1d785e5b95fa2464e7968b5cab079612d70d839","ssdeep":"","tlshash":"1ba002935a5ef66c209044860696e74733823d6a3477b1d625bc5509e6061474817257","first_seen":"2025-05-14T05:06:37.199299Z","last_seen":"2026-03-18T19:40:26.76398Z","times_seen":5502,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/2383c13e2d.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:53.022Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/sys-technical-pages-app-static/Desktop/Default/2383c13e2d.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:53 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 812\r\ntraceparent: 00-03b7f73a8a65c1449506079fcc9522ad-8119549830a077f6-01\r\nlast-modified: Wed, 12 Nov 2025 14:02:13 GMT\r\netag: \"7f85c1dc682c1717c34e0317143a2936\"\r\nx-amz-meta-mtime: 1762956023.840274127\r\nexpires: Thu, 13 Nov 2025 14:06:15 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 78901\r\ncache: HIT\r\nx-cached-since: 2025-11-13T14:09:52+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":812,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (811)","md5":"7f85c1dc682c1717c34e0317143a2936","sha1":"0e6740b6019e4398f92a2ab5b8cfa8c749a57e36","sha256":"4c3fb17517b3f56d123be8634cd6ab5c679537018289740ef248fc515a991d5e","sha512":"95dda2162789364fee02e7cd064957653fc03eb8fb30c4cc40edecc816520ec853938443cb8878c8ba713b7d041dea1e0f6a405473c5d5d7dde20cf6cae17e9e","ssdeep":"","tlshash":"570141ff5fb290382685b8c82ecd756191c0acab0747a0a482cc11c2d3410145a4aaeb","first_seen":"2025-11-12T14:09:39.054175Z","last_seen":"2025-11-20T10:41:57.636188Z","times_seen":166,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/captcha-api/assets/hunt-captcha.js","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:00.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /captcha-api/assets/hunt-captcha.js HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/en/block\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1280; che_g=22b78b6c-0d92-4b18-a655-a4392ed48553; SESSION=13033e2b8d7c5d02143e1c584c11d481\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:00 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 22737\r\ncache-control: public, max-age=300\r\ncontent-encoding: gzip\r\netag: 99138712bc505690b0578f31bc82a540\r\nvary: Accept-Encoding\r\nx-dt: 1103\r\nx-request-id: 67ccfc0138e0464e73ebf43bdcbc3624\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.087, wf-uht;dur=0.024\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":88211,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"99138712bc505690b0578f31bc82a540","sha1":"d580727b84630a468e5a7d2f49bf3daefa21caec","sha256":"b4ba8465ec038c66e61fd44d2c38bbcb4d0580db6be4b04c1479dc938952a719","sha512":"2df3bf3f99136219b514bf0d04ee81703eef14f2fb8be3e1e652c8078d4e43cfff7bbc54f8041ce3d3b2a39d166eb02a6a199295abce152218ee71876b1aed2f","ssdeep":"768:gtpmtrL3IN6RwCc15kf4hLenrXpklqxe64zHID+ijA1JeklYAczsP5pfvyjDfCtr:FL326RXc4fg0lHSUOND37CSt5w3CT","tlshash":"ce831ec4289ca6457bab4869be7f4de5f50b9c7eaa940ac55436ff08203c1f59f88133","first_seen":"2025-11-04T13:30:50.137692Z","last_seen":"2025-12-11T09:33:36.666737Z","times_seen":972,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"region1.analytics.google.com/g/collect?v=2\u0026tid=G-7JGWL9SV66\u0026gtm=45je5bc1v897130004za200zd897130004\u0026_p=1763121902306\u0026gcd=13l3lPl2l1l1\u0026npa=1\u0026dma_cps=syphamo\u0026dma=1\u0026cid=590871141.1763121903\u0026ecid=1693062177\u0026ul=en-us\u0026sr=1280x1024\u0026frm=0\u0026pscdl=noapi\u0026_eu=AEAAAAQ\u0026_s=1\u0026tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115495938~115583767~115616985~115938466~115938469~116217636~116217638~116474636\u0026sid=1763121902\u0026sct=1\u0026seg=0\u0026dl=https%3A%2F%2F1xlite-837593.top%2Fen%2Fblock\u0026dt=1xBet\u0026en=scroll\u0026ep.optimize_id=GTM-5R4MT54\u0026epn.percent_scrolled=90\u0026upn.ref_id=1\u0026tfd=13054","fqdn":"region1.analytics.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"216.239.34.36","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:02.787Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Oct 2025 08:37:33 GMT","end":"Mon, 05 Jan 2026 08:37:32 GMT"},"fingerprint":{"sha1":"6D:B1:20:6C:4E:45:23:88:91:95:5C:C3:FE:0D:A8:1B:29:43:20:6A","sha256":"15:E2:87:29:F5:07:FE:12:A2:58:8F:EE:D0:AD:2A:AC:63:5D:69:08:82:23:F9:BD:90:70:9F:09:AA:7B:57:8B"}}},"request":{"raw":"POST /g/collect?v=2\u0026tid=G-7JGWL9SV66\u0026gtm=45je5bc1v897130004za200zd897130004\u0026_p=1763121902306\u0026gcd=13l3lPl2l1l1\u0026npa=1\u0026dma_cps=syphamo\u0026dma=1\u0026cid=590871141.1763121903\u0026ecid=1693062177\u0026ul=en-us\u0026sr=1280x1024\u0026frm=0\u0026pscdl=noapi\u0026_eu=AEAAAAQ\u0026_s=1\u0026tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115495938~115583767~115616985~115938466~115938469~116217636~116217638~116474636\u0026sid=1763121902\u0026sct=1\u0026seg=0\u0026dl=https%3A%2F%2F1xlite-837593.top%2Fen%2Fblock\u0026dt=1xBet\u0026en=scroll\u0026ep.optimize_id=GTM-5R4MT54\u0026epn.percent_scrolled=90\u0026upn.ref_id=1\u0026tfd=13054 HTTP/1.1\r\nHost: region1.analytics.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\naccess-control-allow-origin: https://1xlite-837593.top\r\ndate: Fri, 14 Nov 2025 12:05:02 GMT\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\naccess-control-allow-credentials: true\r\ncontent-type: text/plain\r\ncross-origin-resource-policy: cross-origin\r\ncontent-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:164:0\r\ncross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:164:0\r\nreport-to: {\"group\":\"ascnsrsggc:164:0\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:164:0\"}],}\r\nserver: Golfe2\r\ncontent-length: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T18:47:00.89111Z","times_seen":13342615,"resource_available":true,"data":null}},"time_used":141,"timings":{"blocked":60,"dns":0,"connect":8,"send":0,"wait":20,"receive":0,"ssl":51},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/app-0950f523.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.640Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/app-0950f523.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-bc2f428e6e73172cb1049a8b4fc23f8d-9d64f3f34ca750df-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:00 GMT\r\netag: W/\"4e8159e169f65701671deaf5e9b0837a\"\r\nx-amz-meta-mtime: 1762953359.733534115\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:31 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81303\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:29:48+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":458565,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"4e8159e169f65701671deaf5e9b0837a","sha1":"e89f1fc388d4289427c57f6d29dce6585339f148","sha256":"1eb367b9aba8a2af96a199695f8f46458b0fbd4058973b60acb54b307be1ec08","sha512":"f44d4842088e823320aa89a75428e442d388b7ca24ca264c2e204abcba375bf926fc7367de1b9ad2ad48e24a5f97835f93557eb0d0330156104d0a502f9f17e2","ssdeep":"6144:oLeU/mOhAn7sWt4cYsKZjhRx5YZZF91F/SIC+v6l3j3w3p+GZsQFaMJmHyX0AN30:I/mhLE+ZH4G0/W6fXztk4","tlshash":"93a44c65b5c8f4ca02e34bdae03a0161e33916b9780dd064f778fdca359bc05926a67f","first_seen":"2025-11-12T14:09:39.078732Z","last_seen":"2025-11-17T09:04:21.037271Z","times_seen":103,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/b5cd9a5e87d930de856c92da15aa121e.png","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.667Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-285/desktop/media_asset/b5cd9a5e87d930de856c92da15aa121e.png HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: image/png\r\ncontent-length: 653\r\ntraceparent: 00-2520801e82501fb67f22140d1922be22-251616409cd3ecb5-01\r\nlast-modified: Wed, 26 Jun 2024 08:18:02 GMT\r\netag: \"e6f0766cbd95db33da44e7a9140648f2\"\r\nexpires: Thu, 16 Jan 2025 10:46:36 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2290\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:26:41+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":653,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit colormap, non-interlaced","md5":"e6f0766cbd95db33da44e7a9140648f2","sha1":"5f196b1bfe8c3f92bd2ebcd67124e72e81ae6aaf","sha256":"c0399d478788d5d483f104a2e8cb7c32f41cb40e9df0c22e831b2bfa2db63ec0","sha512":"249da39baba03408de98c7fa9a9342ef120436037ab6245b3b4a5f1a206291caaf67481c6ed67064544576697d41ab82499abffec998d837812292a050bf826a","ssdeep":"","tlshash":"90f083e032254a855c02ac7fc33414448fb226cc3682bb09e012887119d24a79dd1368","first_seen":"2023-04-05T22:56:35Z","last_seen":"2026-04-03T12:07:45.643999Z","times_seen":6597,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_vue_deps_QPSMQ63M.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.587Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/shared-assets/__shared_vue_deps_QPSMQ63M.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-d98abded7dc6fd71f709ea7d0d763535-66244a7223c71e4f-01\r\nlast-modified: Fri, 14 Nov 2025 10:52:58 GMT\r\netag: W/\"111b97a8a36341794fc296cb6979d884\"\r\nx-amz-meta-mtime: 1763117524.766138313\r\ncontent-encoding: gzip\r\nexpires: Sat, 15 Nov 2025 11:31:39 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 1910\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:33:02+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31420,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (31280)","md5":"111b97a8a36341794fc296cb6979d884","sha1":"9212f43c6d7643c8ccd5f20715a1a29b2c62d1f3","sha256":"7af238cd402218a59d817a1ff57ce4e9a123213b2d9b08ae97fd1d9575e82509","sha512":"f6e7d49683020ae21c09399f40dfe3a25c8a4654a96661294a0c0ebbdeb62cd8803ceb94cd8cfd25aae8acd4c6987f45633afd92d07b369e9cb423f40d5f49b4","ssdeep":"768:2AwZ1yyQBv4Hz+asCmaUOTfh5iwVwBo5Yy7Ys5CW0J7/FIs11O4:2AwWBv4Hz1sCmaUOTfdVco5YyUs5CW0N","tlshash":"bfe25cc8b779bca2335e908c90370313b37559e7584d9030f7a65ea231a564282e7f7e","first_seen":"2025-10-30T11:47:43.17512Z","last_seen":"2025-12-04T11:07:38.466417Z","times_seen":1062,"resource_available":true,"data":null}},"time_used":3,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:01.292Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2 HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:01 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 63748\r\ntraceparent: 00-a27c31a329ae0d609ced875ea2809950-2e2a15d2426234a4-01\r\nlast-modified: Wed, 14 Jun 2023 09:49:53 GMT\r\netag: \"6887b6f24414dbc612dbf42ccdc76b70\"\r\nexpires: Thu, 16 Jan 2025 10:32:14 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 642\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:54:19+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":63748,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 63748, version 1.0","md5":"6887b6f24414dbc612dbf42ccdc76b70","sha1":"8068d3abfbc6cbf35b55919da45b1f4d2d136238","sha256":"fc5c015fc32518f1ed810fa84ca28941eb9d5a3c81acc8df69a4dbbeedef7b0c","sha512":"00f08f9dd648972c9571547e06172d5505dd13f577fe2e65a497d3856172807ac11c996984e4138d2eb2ac784257fe61864aee15752fe9e9e76f98db931e0c2a","ssdeep":"1536:KtdCG+Dz6RxAx457zL0ASEn091Y0H1mTOzI/OzMFOoTX4u:MMG+yRpzN091Y0VtI/pOoTt","tlshash":"8b5302485551fae2cac3073c0f7a89dbb37a776d519224cd98b69f830d37964bea2070","first_seen":"2023-06-14T19:15:49Z","last_seen":"2026-04-04T17:39:02.503075Z","times_seen":10298,"resource_available":false,"data":null}},"time_used":4,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/analytics-fe1636b1.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:02.299Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/analytics-fe1636b1.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:02 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-790805d9dc45893af4c0a0d516d89fea-daa90c7bac9cb63c-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:00 GMT\r\netag: W/\"73d4c420e89c558b4bc9c1744bd10140\"\r\nx-amz-meta-mtime: 1762953359.732534112\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:51 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.001\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81200\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:31:42+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9435,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (9435), with no line terminators","md5":"73d4c420e89c558b4bc9c1744bd10140","sha1":"dd3301119f1c8f21d71d0a8b2a6ecbc15a3ea947","sha256":"c350ebedd3556010929ed821d9522bfeca5c92fa4877372285e78998723414e1","sha512":"c4f0581fffc08acd672d3da4aebe183a448683902315a6bdc96b064fb2dfa5a59143980d0a49cdfb58534d8a8122504a7cbf89fb9fc8dd3c8f40b1b341896f63","ssdeep":"192:8vOGjPZxnEW5+vXjV3VeA9qshuvWa9wHWJ3vQFtRnOMPQz77vO6Rx+qkJ/vO9O:IjPZxnEW52J3VeAcbvWa9wHWFQFHOMPJ","tlshash":"0312a78e7d88e83007ba19b8f67f9a0ae07657172406c051caf9d8843d7da8f511becd","first_seen":"2025-11-12T13:10:30.969619Z","last_seen":"2025-11-20T09:36:24.046621Z","times_seen":165,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en?tag=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-14T12:04:49.740Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /en?tag=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:50 GMT\r\nlocation: https://1xlite-837593.top/en/block\r\nserver-timing: dt_total;dur=0.013, total;dur=264;desc=\"Nuxt Server Time\", wf-uht;dur=0.276\r\nset-cookie: platform_type=desktop; Path=/; Expires=Mon, 17 Nov 2025 12:04:49 GMT; Secure; SameSite=None; Partitioned\ngw-mm=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Secure; SameSite=None; Partitioned\ngw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; Path=/; HttpOnly\nlng=en; Path=/\ncookies_agree_type=3; Path=/\ntzo=1; Path=/\nis12h=0; Path=/\nreferral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; Path=/; Expires=Tue, 13 Jan 2026 12:04:50 GMT\nreflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; Path=/; Expires=Fri, 14 Nov 2025 13:04:50 GMT\npostback_watcher=; Path=/; Expires=Fri, 14 Nov 2025 12:04:54 GMT\nauid=U5Pgn2kXGuJg9yU4AwNKAg==; path=/; secure; httponly; samesite=lax\r\nx-dt: 1103\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":255466,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T18:47:00.89111Z","times_seen":13342615,"resource_available":true,"data":null}},"time_used":657,"timings":{"blocked":176,"dns":89,"connect":27,"send":0,"wait":304,"receive":0,"ssl":57},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/Page.Block-93e7a560.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/Page.Block-93e7a560.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 475\r\ntraceparent: 00-20602808307379196b8c2f6ea7b93ae3-fd5391948a1b58db-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:00 GMT\r\netag: \"4688921dd58bd12524ba60852e763123\"\r\nx-amz-meta-mtime: 1762953359.729534103\r\nexpires: Thu, 13 Nov 2025 13:28:04 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 80551\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:42:20+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":475,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (475), with no line terminators","md5":"4688921dd58bd12524ba60852e763123","sha1":"5c222365a788acc952948e8b2aa1587f4fde9920","sha256":"4f8d584258ec2d305f82a30c11816062d3710d638a3abafa3a81b569b9a64548","sha512":"ddbb8f616154fba47fb0c0f8816c1bcdb4ff080f301c792499231d257a840bda1041ac0540c1ef4cff92b835e50a0760787bff1a0c7c505ff159fff6333017ea","ssdeep":"","tlshash":"40f00e9b2462fc8e95e6008743bac1f7b48c797a0649682002a0c8b132b6826081128f","first_seen":"2025-11-12T13:10:31.006041Z","last_seen":"2025-11-20T09:36:24.059026Z","times_seen":162,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_registration/en/dictionary_40e369da4c6f4d1ebb800d2f982e111b.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.067Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/web-app-v2/dictionary2/v3_registration/en/dictionary_40e369da4c6f4d1ebb800d2f982e111b.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ntraceparent: 00-340a65b0dd6b0e26184c583be4952a5e-e5e753784f876dbd-01\r\nlast-modified: Thu, 13 Nov 2025 12:07:52 GMT\r\netag: W/\"50da5f10060f2fdc0111d5461f4da970\"\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:24 GMT\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 1880\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:33:32+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28249,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"8999f6a204fbd68d38a058781c1373e2","sha1":"2b8c6e61caa50d89405856cde8cab7ea528e1eb6","sha256":"61a18ee3f6c06d149a4170caf4e55e901f979ae9ea401b5b2796dba1924041e8","sha512":"3efc51f8b55ecac3c599d4f14ee6e6535c2126bc618263b023cebee8302cbc0383bb4371b7199fa27bc0aafb299176b4b863b863698bf2f3101bbe95976b77b2","ssdeep":"768:yHLWUDDhxkPJ+32jQbIQI1O5yKcJ+PkXTqC:UL33MQ0J+PkXTqC","tlshash":"68c2d74faf648c7307c3461b7d8b1baa22be0158369218548fbe8a7d1375b91d33389d","first_seen":"2025-11-13T12:36:46.92826Z","last_seen":"2025-11-21T15:37:30.373021Z","times_seen":208,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_express_day/en/dictionary_67b69522f83227c7b5ef835272efd0fb.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/web-app-v2/dictionary2/v3_express_day/en/dictionary_67b69522f83227c7b5ef835272efd0fb.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ntraceparent: 00-af6f0bd9a78bfbcf5926e836367132c0-f55d5bf36af447c1-01\r\nlast-modified: Wed, 15 Oct 2025 12:07:40 GMT\r\netag: W/\"f45468fcd70f76e5e6fa8addfa2e49c0\"\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nexpires: Wed, 15 Oct 2025 13:13:04 GMT\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 11\r\ncache: HIT\r\nx-cached-since: 2025-11-14T12:04:41+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1237,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"f45468fcd70f76e5e6fa8addfa2e49c0","sha1":"ad320e244a89e3c76e71dcee3ba277a3501fe16e","sha256":"ed73b35495fa13c5eeca0d053e5a48d297cd8e2e339b99d3aea9daacb6681f74","sha512":"6055c7fcba989aa364bf8e2b47ca597f69c11f5d5227386e87f4d6594d754c60dc5671b1155b50ef4cf2ccad166bab2ab220221e2dddfb8c78228a5e2d965685","ssdeep":"","tlshash":"5e21cba71035073e9d132b2fad7f529006c04c5152e8b487379f39fb378cd949e6966a","first_seen":"2025-10-15T12:35:50.133678Z","last_seen":"2025-11-21T08:50:14.818683Z","times_seen":1223,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.138Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\nContent-Type: application/json\r\nX-Lang: en\r\nX-Uuid: c859b9ae-2f21-4c2d-9754-c161720a7554\r\nContent-Length: 98\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; postback_watcher=; auid=U5Pgn2kXGuJg9yU4AwNKAg==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 23\r\nx-dt: 1103\r\nx-time-ng: 0.001\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.111, wf-uht;dur=0.008\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"82b21c3a8444d6875a9a450bd10cdfdd","sha1":"5c68d182223149c211b1436b56ce6a9630642c59","sha256":"a8553fc8b1d3c2a49a4f7d11a1bf27a1659c7e839d498b45ef9481e1291e382c","sha512":"9b09bb0ad6516f82ae6741b92be16f358bf6b748c5c46d929ac50280c06a9188a58fb68bb17e2e54310626396474d0da48b2134ded8ccc8e43f1645ec08a2a54","ssdeep":"","tlshash":"4670008c000c02c002088800828088000e32a08020000a2280c0c2030000cf20a8f00b","first_seen":"2025-11-14T12:05:26.778143Z","last_seen":"2025-11-14T12:05:26.778143Z","times_seen":1,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/8192228305b202797f207eeb6842287c.png","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.350Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-285/desktop/media_asset/8192228305b202797f207eeb6842287c.png HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: image/png\r\ncontent-length: 5202\r\ntraceparent: 00-3a8d62d8384052e2d03c3931d063a28a-31f74f52fb888649-01\r\nlast-modified: Wed, 26 Jun 2024 08:22:59 GMT\r\netag: \"b9a636eef54b2844b571fe7de49184a7\"\r\nexpires: Tue, 07 Oct 2025 21:12:04 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\ncache: REVALIDATED\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5202,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 514 x 514, 8-bit colormap, non-interlaced","md5":"b9a636eef54b2844b571fe7de49184a7","sha1":"bf653690790ced40eb3189da075a275d951d1607","sha256":"001bfcdd52b658d46543a1aec889d35b73b3909b47097cc011b95e96fc9e3743","sha512":"7b288a27a69c91697042ebb6f80f48cf25e0c6260620ee8f4b0e7afa75430b95c394c3f284445e0628b347341b89480e2e7098510bc07f4db43ecc46d893c38f","ssdeep":"96:561aQaPXOi0Ui/+kgrJtv72TgGuDG9JAsXgQrjQ:470T0PEnv7Sgc9vPQ","tlshash":"56b19e22d46fe4a53230c81b67c1820a1df839c6e72c29d0e8ed4db5e2c8b7f84883c4","first_seen":"2023-11-17T17:46:27Z","last_seen":"2026-01-13T06:38:33.673472Z","times_seen":5260,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"radar.cedexis.com/1/23802/radar.js","fqdn":"radar.cedexis.com","domain":"cedexis.com","tld":"com"},"ip":{"addr":"45.54.49.5","port":443,"asn":63911,"as":"NetActuate, Inc","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:02.412Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"radar.cedexis.com","organization":"Citrix Systems, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Fri, 07 Mar 2025 00:00:00 GMT","end":"Fri, 06 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A2:3E:30:19:D5:41:3A:11:81:58:E3:B1:6F:F4:D2:78:0B:44:6F:D0","sha256":"BE:70:39:96:BA:51:8F:A7:6A:9D:E1:58:FB:D9:F7:6F:17:5C:DA:A9:6E:54:3F:8F:0B:3D:1E:DF:8C:44:B4:71"}}},"request":{"raw":"GET /1/23802/radar.js HTTP/1.1\r\nHost: radar.cedexis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Moved Temporarily\r\nServer: nginx\r\nDate: Fri, 14 Nov 2025 12:05:02 GMT\r\nContent-Type: text/html\r\nContent-Length: 138\r\nConnection: keep-alive\r\nLocation: /1707728419/stub.js\r\nExpires: Fri, 14 Nov 2025 12:15:02 GMT\r\nCache-Control: max-age=600\r\nVary: User-Agent,DNT\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Moved Temporarily","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":390,"size_decoded":0,"mime_type":"application/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T18:47:00.89111Z","times_seen":13342615,"resource_available":true,"data":null}},"time_used":118,"timings":{"blocked":48,"dns":0,"connect":20,"send":0,"wait":22,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-ui/2.3.467/Desktop/Default/client.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-ui/2.3.467/Desktop/Default/client.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css; charset=utf-8\r\ntraceparent: 00-bf0c3dddf4a8ba558ad0ef05537c5f21-ed6cde7237f63e83-01\r\nlast-modified: Mon, 27 Oct 2025 12:07:39 GMT\r\netag: W/\"17d41a4370febdb3c5a299f1ccf3f8b5\"\r\nx-amz-meta-mtime: 1761566857.676623982\r\ncontent-encoding: gzip\r\nexpires: Fri, 07 Nov 2025 10:43:23 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.003\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 4518\r\ncache: HIT\r\nx-cached-since: 2025-11-14T10:49:33+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":617380,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"17d41a4370febdb3c5a299f1ccf3f8b5","sha1":"746953ea944e80b043b9170c0df238d13ff67d4e","sha256":"a256552abab5332be680c356b48c5039463f5844002ec791f919981a8634cdee","sha512":"156adada8e10aa741692268bc647531bd10bc943714ac4f984b7c1135e2173c26cbff5ade9787441a1822cbbfc419b94bd37d70f457f0fccfb656fb1e24b6cc3","ssdeep":"6144:+QTPSTqKH7I7hiDONDhQaBnAsCIotova5Uz1KfN6SLe/p739DuZtDD/q90LgrUtU:ETqrN5A1ege/p739DuZR/q90LG1d","tlshash":"56d4841cf25e91353e37e62162844ffc2630b7579a221c7ff49a029a0ec355371a6dab","first_seen":"2025-11-06T10:58:42.416079Z","last_seen":"2025-11-20T09:36:24.048593Z","times_seen":435,"resource_available":false,"data":null}},"time_used":102,"timings":{"blocked":41,"dns":2,"connect":4,"send":0,"wait":2,"receive":0,"ssl":47},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_auth/en/dictionary_70b2859a71b49c51319ac9e3e1cb4461.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.065Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/web-app-v2/dictionary2/v3_auth/en/dictionary_70b2859a71b49c51319ac9e3e1cb4461.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ntraceparent: 00-03faf16159aacefddf18707c1b3a4eb0-6089e6cf30162dbc-01\r\nlast-modified: Thu, 13 Nov 2025 14:07:57 GMT\r\netag: W/\"c5095171e51dc67a522e1593f5627797\"\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 15:27:20 GMT\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2026\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:31:06+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9708,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"c5095171e51dc67a522e1593f5627797","sha1":"04e0a0ca535fbf9a06f179df116ca266eccb3132","sha256":"1be9328402e2d3bbc1d4c8d00b15cb59ce226b5a63681b648157d561314b2da8","sha512":"2d9f5543dbf063b71249115f296f9ac230a69b997851fe09c69a358d7eb49afe721c5f85535f525ac6c85f8df23e0a57c9327ef4fbf757d52b2285d651da0f33","ssdeep":"192:HvhX8mmq4spyU7SKi5mD8jrUAIOFJM1YABslAByZhqV+2p+QvM9pKTp:HvhX8mmqdsU7ziUeJM1YABsOByZh4nMM","tlshash":"b012011a817a0c57cfdbca827c495b5ce3a409b446b84cad8cf9c23e07a2765d6af354","first_seen":"2025-11-13T15:27:51.527043Z","last_seen":"2025-12-25T02:38:59.053043Z","times_seen":600,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/hd-api/external/verify","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:01.884Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"POST /hd-api/external/verify HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\nContent-Type: text/plain;charset=UTF-8\r\nContent-Length: 191465\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1280; che_g=22b78b6c-0d92-4b18-a655-a4392ed48553; SESSION=13033e2b8d7c5d02143e1c584c11d481\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:02 GMT\r\ncontent-type: application/json\r\ncontent-length: 820\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nx-dt: 1103\r\nx-request-guid: b93e1e2b587a84a191789046fa3be01c\r\nx-time-ng: 0.006\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.088, wf-uht;dur=0.028\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1035,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"da899e6974143df03b920a57dfb0cfab","sha1":"dc10a93354d95281e789a40d4509f7a91a2578a8","sha256":"4d9d4189623549de140b01e182f840fa6b9792e20a90096e16e624ad737411fa","sha512":"ffbaae1f8c99595a1568d8969ee5f9f9d7ab0ac4bd2b861a60e3a44511a8c7f6fc93a523c690afbdb9ceca591ae3586e9615d31bb55f3306163b9c24a3ec2a03","ssdeep":"","tlshash":"4311d84440aa1b3c19d67448a5ad28b291867b7518f156230dcf55e9bd3b68000ff0f0","first_seen":"2025-11-14T12:05:26.78352Z","last_seen":"2025-11-14T12:05:26.78352Z","times_seen":1,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":0,"dns":0,"connect":0,"send":46,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.google.no/ads/ga-audiences?v=1\u0026t=sr\u0026slf_rd=1\u0026_r=4\u0026tid=G-7JGWL9SV66\u0026cid=590871141.1763121903\u0026gtm=45je5bc1v897130004za200zd897130004\u0026aip=1\u0026dma=1\u0026dma_cps=syphamo\u0026gcd=13l3lPl2l1l1\u0026npa=1\u0026frm=0\u0026tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115495938~115583767~115616985~115938466~115938469~116217636~116217638~116474636\u0026z=2032935178","fqdn":"www.google.no","domain":"google.no","tld":"no"},"ip":{"addr":"142.250.74.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:02.786Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google.no","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Oct 2025 08:40:42 GMT","end":"Mon, 05 Jan 2026 08:40:41 GMT"},"fingerprint":{"sha1":"CA:58:42:78:A3:44:AF:4A:9B:4E:4A:39:48:B2:89:A1:30:9C:F1:EC","sha256":"56:01:96:EE:58:A5:32:AF:4B:B5:E7:88:8B:C4:CC:44:15:74:01:99:B3:84:72:B3:E8:66:ED:6D:17:42:C1:EE"}}},"request":{"raw":"GET /ads/ga-audiences?v=1\u0026t=sr\u0026slf_rd=1\u0026_r=4\u0026tid=G-7JGWL9SV66\u0026cid=590871141.1763121903\u0026gtm=45je5bc1v897130004za200zd897130004\u0026aip=1\u0026dma=1\u0026dma_cps=syphamo\u0026gcd=13l3lPl2l1l1\u0026npa=1\u0026frm=0\u0026tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115495938~115583767~115616985~115938466~115938469~116217636~116217638~116474636\u0026z=2032935178 HTTP/1.1\r\nHost: www.google.no\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\np3p: policyref=\"https://www.googleadservices.com/pagead/p3p.xml\", CP=\"NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC\"\r\ntiming-allow-origin: *\r\ncross-origin-resource-policy: cross-origin\r\ndate: Fri, 14 Nov 2025 12:05:02 GMT\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\ncontent-type: image/gif\r\nx-content-type-options: nosniff\r\nserver: cafe\r\ncontent-length: 42\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":42,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-04-04T18:45:00.976237Z","times_seen":763771,"resource_available":true,"data":null}},"time_used":366,"timings":{"blocked":163,"dns":0,"connect":21,"send":0,"wait":37,"receive":0,"ssl":143},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-285/desktop/media_asset/3083a20a3f73c30fce38710d7ada9cbb.svg","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.186Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-285/desktop/media_asset/3083a20a3f73c30fce38710d7ada9cbb.svg HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: image/svg+xml\r\ntraceparent: 00-166487f1b563db3ba03c2a71e15a433b-17322a58b3979a43-01\r\nlast-modified: Wed, 19 Apr 2023 11:51:30 GMT\r\netag: W/\"3ae81b002dca46d3b732ce3e03ae35c6\"\r\ncontent-encoding: gzip\r\nexpires: Thu, 16 Jan 2025 11:13:48 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2092\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:29:59+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1228,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3ae81b002dca46d3b732ce3e03ae35c6","sha1":"388d37b5f714937677de74330a8daab0a0d1196b","sha256":"1c76b93f07c6a861c4ad9529059ea99ae69f2451788da7cab1f17fa94d54382e","sha512":"48887848044da3a9a54b72a1f15a39ac0b30ea8ad7ddc3d4c69e51bb0479f39631d4b9098d289eecdaa9648db4118ddfa38cf76ef1a58718c67d70efc80a67a8","ssdeep":"","tlshash":"e72124be434d5bfb60025fd8967802513abaf0c2f29926ed55d674227903cf4d074955","first_seen":"2023-04-05T22:56:35Z","last_seen":"2026-04-04T17:37:53.413355Z","times_seen":1389,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":30,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2 HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 63920\r\ntraceparent: 00-0f1f15c061978d50439e5bc6c5db1cb6-8edb727c048e572d-01\r\nlast-modified: Wed, 14 Jun 2023 09:49:53 GMT\r\netag: \"a65527fcb58f66a7cfbc0e6b160538b4\"\r\nexpires: Sun, 10 Aug 2025 19:21:26 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 3348\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:09:03+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":63920,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 63920, version 1.0","md5":"a65527fcb58f66a7cfbc0e6b160538b4","sha1":"45d260e7fa343401b5bb0df982a014f53e2d253b","sha256":"fb13c3a1cbac60649b76f7d7f85c1645d35ac69b85ce5f4eb0692505ecc2cd45","sha512":"8448e96abe326f43285b2d8b0d75beaf0e9c9e051e8754841d907b30eb303ae24c447011306da6a1703b9192d02aeff76a4517bdf94ec6e7dc360ce3538802af","ssdeep":"1536:UIG3hJMkJeK8ic5iZGnJ4URj9vqXOQ6UqYdbuA5RVK1:UL31hcLlRjDQ6Uq4W1","tlshash":"7f5302df8de32a148ff78772668885f4f4927c68898c8e7345526a8907f07d6b96c04f","first_seen":"2023-05-07T18:04:27Z","last_seen":"2026-04-04T17:39:02.424617Z","times_seen":10176,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/seo-module-api/api/public/v1/analytics-counters?project[id]=1103\u0026domain[host]=1xlite-837593.top","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /seo-module-api/api/public/v1/analytics-counters?project[id]=1103\u0026domain[host]=1xlite-837593.top HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\ncontent-type: application/json\r\nx-requested-with: XMLHttpRequest\r\nx-app-n: v3-nuxt2\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; postback_watcher=; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1920\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 47\r\ncontent-encoding: br\r\ncache-control: max-age=1200, must-revalidate, public, s-maxage=1800, stale-if-error=86400, stale-while-revalidate=300\r\nx-content-digest: enb066c3de982d01779fd50476f73b1ab6\r\nage: 1660\r\nx-request-id: 1466b256682d71f0450c5f48e12e40f7\r\nx-request-guid: 1466b256682d71f0450c5f48e12e40f7\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: p;dur=1.3110637664795, wf-uht;dur=0.009\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c809138c09727a461b3438eb080f8445","sha1":"2b43a325cd3d2b7a1d91967f30bb52c4e136822b","sha256":"47d34e128cb5a1e2edb0f30e9a15ec1c79a82bc64c512b53702ddf6a5a33f74c","sha512":"31a4a640ba00124b48f424535b4e79e3a42bc44f84c4fec2ed52461131ce90e68d090804b9c30c40abc780edefd8321e261403fe80b0e113af509952ecb7e892","ssdeep":"","tlshash":"0490045177057d54d40750c444454553411c50d5cf5111033d54c733c17d35470c7517","first_seen":"2024-04-27T00:40:23Z","last_seen":"2026-03-30T00:11:58.747679Z","times_seen":455,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/7af4a4ed2e.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:53.082Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/sys-technical-pages-app-static/Desktop/Default/7af4a4ed2e.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:53 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-85469a724f106ef96d46b1f24365407c-1b43e90aaad3f2bd-01\r\nlast-modified: Wed, 12 Nov 2025 14:02:13 GMT\r\netag: W/\"8a75e2a7f5e98518b7ec241719c1c690\"\r\nx-amz-meta-mtime: 1762956023.84127423\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 14:06:15 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.001\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 78901\r\ncache: HIT\r\nx-cached-since: 2025-11-13T14:09:52+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1970,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (1969)","md5":"8a75e2a7f5e98518b7ec241719c1c690","sha1":"ad88a9521cd3cb9950eb8e8ab0bc9f0eb49b9f23","sha256":"2bfb13772b5a7074e2b8aba022bcdae4e2cb67a17522e3a807bbc7e7b5733fde","sha512":"80422eeba487ce9210c21b81b7694d9026bc88c8b55065be75a2ff085794ba4588990902dbc4fd59f359c338d4d06f97e46422f2d030beabe822c790b879a32d","ssdeep":"","tlshash":"3741c8d6b2b035f3e677516dbc0660f1c3182a9d132e10e4e9e9484e220c9c32767793","first_seen":"2025-11-12T14:09:39.054948Z","last_seen":"2025-11-20T10:41:57.594364Z","times_seen":166,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:01.642Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2 HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:01 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 63748\r\ntraceparent: 00-e7f99ecad3f9611277a137bca82f1c98-4e0bf7631fe37972-01\r\nlast-modified: Wed, 14 Jun 2023 09:49:53 GMT\r\netag: \"6887b6f24414dbc612dbf42ccdc76b70\"\r\nexpires: Thu, 16 Jan 2025 10:32:14 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 642\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:54:19+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63748,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 63748, version 1.0","md5":"6887b6f24414dbc612dbf42ccdc76b70","sha1":"8068d3abfbc6cbf35b55919da45b1f4d2d136238","sha256":"fc5c015fc32518f1ed810fa84ca28941eb9d5a3c81acc8df69a4dbbeedef7b0c","sha512":"00f08f9dd648972c9571547e06172d5505dd13f577fe2e65a497d3856172807ac11c996984e4138d2eb2ac784257fe61864aee15752fe9e9e76f98db931e0c2a","ssdeep":"1536:KtdCG+Dz6RxAx457zL0ASEn091Y0H1mTOzI/OzMFOoTX4u:MMG+yRpzN091Y0VtI/pOoTt","tlshash":"8b5302485551fae2cac3073c0f7a89dbb37a776d519224cd98b69f830d37964bea2070","first_seen":"2023-06-14T19:15:49Z","last_seen":"2026-04-04T17:39:02.503075Z","times_seen":10298,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/site-admin/css_vars/29b5cda95fa390c124de39b6aeca6d24.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.172Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/site-admin/css_vars/29b5cda95fa390c124de39b6aeca6d24.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css\r\ncontent-length: 46\r\ntraceparent: 00-f8ee04145515e68e9c1bee020b5ab2dc-0ee54ec54d380ab6-01\r\nlast-modified: Thu, 20 Mar 2025 13:29:31 GMT\r\netag: \"29b5cda95fa390c124de39b6aeca6d24\"\r\ncache-control: max-age=3600\r\nexpires: Fri, 26 Sep 2025 20:51:22 GMT\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 480\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:56:51+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":46,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with no line terminators","md5":"29b5cda95fa390c124de39b6aeca6d24","sha1":"46f68f69533c1fdc737eb36e8e7af7672178e610","sha256":"6021ec0aede22eadcb8401fe945d345202320437c7be01b157f0cb282ebe7c88","sha512":"8a62d0b23596f91ed5dbd111fce75e940b4b6fe542716d9fad76d610eb9a90f67bad145f3dcfd977b5a7a6d414d66e94c0abcaf6cabce2310d94af56cdf0e13b","ssdeep":"","tlshash":"54900294a50c22502025c656109c48d0119412566621255851533451b4438405960188","first_seen":"2025-03-20T19:27:14.305804Z","last_seen":"2025-11-18T11:41:52.983768Z","times_seen":4852,"resource_available":false,"data":null}},"time_used":397,"timings":{"blocked":190,"dns":1,"connect":4,"send":0,"wait":1,"receive":0,"ssl":198},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/4d416977b5.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/sys-technical-pages-app-static/Desktop/Default/4d416977b5.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css; charset=utf-8\r\ntraceparent: 00-10b5ad2dae865952be3f20735bac578d-9401fb08f977a2db-01\r\nlast-modified: Wed, 12 Nov 2025 14:02:13 GMT\r\netag: W/\"5c33927153f6d628ea771eb51a514b09\"\r\nx-amz-meta-mtime: 1762956023.84127423\r\ncontent-encoding: gzip\r\nexpires: Fri, 14 Nov 2025 14:51:01 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 76430\r\ncache: HIT\r\nx-cached-since: 2025-11-13T14:51:01+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3884,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (3883)","md5":"5c33927153f6d628ea771eb51a514b09","sha1":"40390b90d99b2d3408d597d24daedc4bf614beda","sha256":"302ec7f61d1e628eba933d5b3c75a98f3135bbbd45af794476a0fcbdf145a9c5","sha512":"edde36cc3523543858227617d05807be04053a8b6a1569452abb135fd96074f99252834da9f54d31ae23bc06d06dcb3a1f57ad65e44686dbfc837ff8d94d82ca","ssdeep":"","tlshash":"19818c58bcaf409cfc37df210bdb5e188276b122d11692c8f841953a2ddb98794f149f","first_seen":"2025-11-13T15:27:51.581732Z","last_seen":"2026-02-17T23:36:16.903884Z","times_seen":837,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":37,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/runtime-46fa722e.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.621Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/runtime-46fa722e.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-7258e9cc59bb1fda1f4f060a96757ce7-71b63469262b8f25-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:01 GMT\r\netag: W/\"bffabc9fa21e6d2a3b9d2aacc6379aff\"\r\nx-amz-meta-mtime: 1762953359.752534175\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:31 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81303\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:29:48+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16786,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (16786), with no line terminators","md5":"bffabc9fa21e6d2a3b9d2aacc6379aff","sha1":"f245ea3c087cf43d7967e078fb299d6f3aec46ee","sha256":"4125e905282c94bc6e2813bf93103e5f0504445081f330314ef982446175ca07","sha512":"6edd2c98238073b78560effbab2dd62a2b9c258b2b46f91f0f0296fb8a0d96ab5473d0838bbd76c0f3ace8c021b884f8c14c1b0629d7ba9a380aa43ab2342d9f","ssdeep":"384:WgoPESVItnw8nINgOEOESVItnwCVnJ20R7MYk1HULjt4:la5Itw8nINgOEO5Itw2nX9lk1H4jy","tlshash":"a7720f5daf1acd671d22ddc338217d21981824335c4647eceafed2194418ea866afe3f","first_seen":"2025-11-12T14:09:39.057602Z","last_seen":"2025-11-17T09:04:21.008234Z","times_seen":103,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_game/en/dictionary_93855f2d53fc019242443f6d410a450d.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/web-app-v2/dictionary2/v3_game/en/dictionary_93855f2d53fc019242443f6d410a450d.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ntraceparent: 00-f9cb7e8ead768dad3bb819a87935f07b-dd422e086de48a00-01\r\nlast-modified: Wed, 01 Oct 2025 16:08:03 GMT\r\netag: W/\"13ca50ce37f849de1b02facfcbc0b235\"\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nexpires: Wed, 01 Oct 2025 17:34:41 GMT\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2365\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:25:27+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25872,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b83e19a4bdf23d17d041a169e2dcb59b","sha1":"328f96aed426a209c6d34425c98f51e9728bbe06","sha256":"b935b5f0de7590df3d4f036e51c3ee68333da4c1bc3d40cd66fd48d9115e3cc6","sha512":"8e4451602adc389e48c391113a5295a484c8dff9b65ff318b53e4c03702adc9ca044bda15fb0e3467153a4604abe47e54a59ff5bcd3fe65fb7676e4ae057a357","ssdeep":"384:i/B1lizv0Ioy4CEMt6tI0EEfqQ4O4cN86WwTCu9o9V38cdZeXiG+/jtx:Ylivt6tI0EEf66WwTCV/QXiGsjtx","tlshash":"fac2fc05285eeca6c3fb86b474e93bd672f089af5b626186fc48742e2c957c5610f40f","first_seen":"2025-10-01T20:08:28.071573Z","last_seen":"2025-11-21T12:37:41.202009Z","times_seen":1679,"resource_available":false,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/7c83ee949a.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/sys-technical-pages-app-static/Desktop/Default/7c83ee949a.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-004c26883fa84f636d37957f80bfb500-4c075ff437ae36d3-01\r\nlast-modified: Wed, 12 Nov 2025 14:02:13 GMT\r\netag: W/\"ad3a3d2317f96322d0bd0bae414eca13\"\r\nx-amz-meta-mtime: 1762956023.84127423\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 14:06:14 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 78901\r\ncache: HIT\r\nx-cached-since: 2025-11-13T14:09:51+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5601,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5078)","md5":"ad3a3d2317f96322d0bd0bae414eca13","sha1":"4b367b3626f9536266d422a09e76afa1e22ac213","sha256":"bb82e2523b400ba9521030d95afc38171855fc725b4ff54098715e0e1260adfb","sha512":"79529a9be80ddac6562c5c75b07b9553bd10e578bcd9208b25737a4769dce65cbe766cb2cd936f81f97b38de9ee5cb7aa679c9e5bf94cec60fead2ae8806842c","ssdeep":"96:Fh2JzYFijJGhVsrTkr9M0kdaEwXqlZTsasW6FPYW2bxie92m3Um72FiAbjn:FhjgjJGhVsv89M0bXqDTsaJuPYWG99nM","tlshash":"95c1e9ad2af934fc256c0e9abe1654f186684c2623bcd4f6db4b0f600738015d666dc6","first_seen":"2025-11-12T14:09:39.074517Z","last_seen":"2025-11-20T10:41:57.60955Z","times_seen":166,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.googletagmanager.com/gtag/js?id=G-5671CMJ6T4","fqdn":"www.googletagmanager.com","domain":"googletagmanager.com","tld":"com"},"ip":{"addr":"142.250.178.104","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:02.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 27 Oct 2025 08:33:50 GMT","end":"Mon, 19 Jan 2026 08:33:49 GMT"},"fingerprint":{"sha1":"48:8A:E6:98:60:86:BA:71:57:34:7F:7F:AB:BA:86:86:8F:73:20:E2","sha256":"AF:F1:47:F8:37:C7:C4:95:30:91:49:71:1C:6F:0E:A8:5A:0D:92:0C:E2:D9:F4:A7:AF:27:C5:6B:39:0D:33:46"}}},"request":{"raw":"GET /gtag/js?id=G-5671CMJ6T4 HTTP/1.1\r\nHost: www.googletagmanager.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: application/javascript; charset=UTF-8\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Cache-Control\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Fri, 14 Nov 2025 12:05:02 GMT\r\nexpires: Fri, 14 Nov 2025 12:05:02 GMT\r\ncache-control: private, max-age=900\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\ncross-origin-resource-policy: cross-origin\r\nserver: Google Tag Manager\r\ncontent-length: 161413\r\nx-xss-protection: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":509265,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (12571)","md5":"a86ff89b4b5adcf3d361d4ab3d3a16f0","sha1":"33886a593909165f799c4e89d52b56883b2e2fc0","sha256":"2efffc751bcc9ca21fd4c8b97465c58c466115fbc6022fae5d4faa16e68d6083","sha512":"ec1fed4cebc3d71673e0ea1db4ae222675b4d5134c5129931c35630f817cd624aa878f3bafaac29e57260cc5499e9a657762324a7844f39500bca902b7e2c8ef","ssdeep":"6144:9J4o7CyZOsjtxj34kbc2sUOJdR+rVmIQZtdSF3kkAi:Tn7ZZOytV5bhsmQZE","tlshash":"a7b4099f73c6742652daf468402f01cba97b24e2b45cc8aab1c9cdf02d7469b4167f78","first_seen":"2025-11-14T08:46:33.427527Z","last_seen":"2025-11-15T06:34:08.921876Z","times_seen":6,"resource_available":true,"data":null}},"time_used":366,"timings":{"blocked":109,"dns":0,"connect":29,"send":0,"wait":61,"receive":87,"ssl":77},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:03.990Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\nContent-Type: application/json\r\nX-Lang: en\r\nX-Uuid: c859b9ae-2f21-4c2d-9754-c161720a7554\r\nContent-Length: 109\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1280; che_g=22b78b6c-0d92-4b18-a655-a4392ed48553; SESSION=13033e2b8d7c5d02143e1c584c11d481; _ga_7JGWL9SV66=GS2.1.s1763121902$o1$g0$t1763121902$j60$l0$h1693062177; _ga=GA1.1.590871141.1763121903\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:04 GMT\r\ncontent-type: application/json\r\ncontent-length: 23\r\nx-dt: 1103\r\nx-time-ng: 0.054\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.047, wf-uht;dur=0.062\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"e41a2c0e37e5110c426f253e8c8cbada","sha1":"447b0f1954ebc79acf340d2b1fb4f524425d16a9","sha256":"83effc828cf6a1624412a32b255f8d3fff6f18e7d862a5f39b17b92b4af705d6","sha512":"4a4efb23a1e353ddc708b449cab5b7895e7ba4507d3103c73db3e367aaa562f4e3f070261ccc412f53c2f3bfc11155ab526aa5052d38b01bd611607ef947fdcd","ssdeep":"","tlshash":"6d700000000c08c00a08c8032200c8300f28a020808020220080ab300880cf0080f002","first_seen":"2025-11-14T12:05:26.795662Z","last_seen":"2025-11-14T12:05:26.795662Z","times_seen":1,"resource_available":false,"data":null}},"time_used":89,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":89,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/en/block","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-14T12:04:50.226Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /en/block HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; postback_watcher=; auid=U5Pgn2kXGuJg9yU4AwNKAg==\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 203 Non Authoritative\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:50 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-length: 255466\r\naccept-ranges: none\r\nserver-timing: dt_total;dur=0.007, total;dur=655;desc=\"Nuxt Server Time\"\r\nset-cookie: gw-mm=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Secure; SameSite=None; Partitioned\ngw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; Path=/; HttpOnly\nlng=en; Path=/\ncookies_agree_type=3; Path=/\ntzo=1; Path=/\nis12h=0; Path=/\r\nx-dt: 1103\r\nx-frame-options: SAMEORIGIN\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"203","status_text":"Non Authoritative","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":255466,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (40143)","md5":"dc5d9d089833c0a1de482df46953f63a","sha1":"c21af3e20b5db02c5b55115fc6a96be2f4dc1e37","sha256":"2f423522120fabbc7483c06d3f9d6bd864d1c888a6295e71ffc9b5ce8b6eb58d","sha512":"06e4145a6d3f76ad940335d9ac12d5f9ec7c2d0b67a17ae6fabcbe3d2e63a85df88428888bbd56b58a098319e42a9cabd9bf549d3801ed5ce3fe99497cec40cd","ssdeep":"3072:w6I54F4iwGLeqJ1E5l00HH4iwZLeqJ1EenHR/98JDNDrWq7mKC:C4F2qw/fqxgDRxKKC","tlshash":"bb44b52fa90c1c3e911f1eb9c98f7e4e57bc5e1620cb6d019caeae2815a7794416343f","first_seen":"2025-11-14T12:05:26.797452Z","last_seen":"2025-11-14T12:05:26.797452Z","times_seen":1,"resource_available":false,"data":null}},"time_used":829,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":734,"receive":93,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/commons/app-287b92ba.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.633Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/commons/app-287b92ba.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-ae48211e6444df0f7b2fb1c9a8fd12ee-63c752076a05bccb-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:01 GMT\r\netag: W/\"665bc1cda6f82ccccc233fe2a9e02f7d\"\r\nx-amz-meta-mtime: 1762953359.752534175\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:31 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81303\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:29:48+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":137774,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65468)","md5":"665bc1cda6f82ccccc233fe2a9e02f7d","sha1":"9cb94dc519d41700a0ab70250bcc4ca9d7192f02","sha256":"20d42f3f8d7575dcdbba48d461ea454ab417e0899ac6c023ca3c8d0376fe32ef","sha512":"05c75328cb74cfd64b369ce8059a64f95625657b06f287802df4d0c7150642b4193abd73dffca6dd1a68ae8177f5af14b7151e5416d6832caeab3c202cff8dda","ssdeep":"1536:XCrmhSG5YGf7BMr3y6MPC0UiXH2DHJjIAG3wvvjE+gjmZVBQ+PWKYfaRtp:KmjYGNMrmXHUp0qXjE+gjmZtNRP","tlshash":"2fd3d5dcf695b03117e721b5407f150bf23a7898680ac0a4f266e8d53db888ea167f7d","first_seen":"2025-11-06T10:58:42.41009Z","last_seen":"2025-11-20T09:36:24.031528Z","times_seen":344,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.992Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/ab.json HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\nContent-Type: application/json\r\nX-Lang: en\r\nX-Uuid: c859b9ae-2f21-4c2d-9754-c161720a7554\r\nContent-Length: 19\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; postback_watcher=; auid=U5Pgn2kXGuJg9yU4AwNKAg==\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 2\r\nx-dt: 1103\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.076, wf-uht;dur=0.011\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"d751713988987e9331980363e24189ce","sha1":"97d170e1550eee4afc0af065b78cda302a97674c","sha256":"4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945","sha512":"b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af","ssdeep":"","tlshash":"c7100000000000000000000000000000000003000000c0000000000000000000000000","first_seen":"2023-03-08T00:02:47Z","last_seen":"2026-04-04T18:45:00.961956Z","times_seen":226965,"resource_available":true,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_localforage_PJNUBKRP.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.590Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/shared-assets/__shared_localforage_PJNUBKRP.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-22a69e67aedee6d2a620a98a0ffe8e51-9ee8ac22ca079593-01\r\nlast-modified: Fri, 14 Nov 2025 07:59:03 GMT\r\netag: W/\"7e7ebd44e3a6550f862e122ab7df6409\"\r\nx-amz-meta-mtime: 1763107046.881269843\r\ncontent-encoding: gzip\r\nexpires: Sat, 15 Nov 2025 09:42:23 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 8549\r\ncache: HIT\r\nx-cached-since: 2025-11-14T09:42:23+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30277,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (30255)","md5":"7e7ebd44e3a6550f862e122ab7df6409","sha1":"384ecbc3ab0f65e6b0f88c1e68ba3eb73fad4999","sha256":"138767518a09e63d24f918f6380923893a2ec3aa59a640e51c83517501823076","sha512":"e2766b50e289dc6a69fa30432a49a0b7743f15cd15a54d707959c7623f258057a821a94285c492746216cfbf815089309b6cc09b930ba7977ff9c4ffc352d76e","ssdeep":"768:wDKAOpvMewHFuM96WwZACjzz46zSTKsBE1OvFXfX1UXk:wm8uPW43zEIOvdlUU","tlshash":"a5d2b68c7799f02683bb3070907f580ef237a912594d90a0e591e5f86dbd75c822bfad","first_seen":"2025-08-22T10:11:14.535778Z","last_seen":"2026-03-04T04:00:43.425133Z","times_seen":3921,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"radar.cedexis.com/1707728419/stub.js","fqdn":"radar.cedexis.com","domain":"cedexis.com","tld":"com"},"ip":{"addr":"45.54.49.5","port":443,"asn":63911,"as":"NetActuate, Inc","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:02.556Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"radar.cedexis.com","organization":"Citrix Systems, Inc."},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Fri, 07 Mar 2025 00:00:00 GMT","end":"Fri, 06 Mar 2026 23:59:59 GMT"},"fingerprint":{"sha1":"A2:3E:30:19:D5:41:3A:11:81:58:E3:B1:6F:F4:D2:78:0B:44:6F:D0","sha256":"BE:70:39:96:BA:51:8F:A7:6A:9D:E1:58:FB:D9:F7:6F:17:5C:DA:A9:6E:54:3F:8F:0B:3D:1E:DF:8C:44:B4:71"}}},"request":{"raw":"GET /1707728419/stub.js HTTP/1.1\r\nHost: radar.cedexis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 14 Nov 2025 12:05:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Mon, 12 Feb 2024 09:50:42 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"65c9e9f2-186\"\r\nExpires: Fri, 28 Nov 2025 12:05:02 GMT\r\nCache-Control: max-age=1209600, public\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":390,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"82dec77fd0353c7c71ce053b8601387e","sha1":"fbbca95419e1d0c042e0a5fdf10f380aca66188c","sha256":"39f2b7b0fa78d37d0c84d2d6618bd635d86fd683d9bcdd5729850cb2a62522f7","sha512":"6872c895cb44711405e57a436dfbe15d094f9159e11ee2b89983c63b1f18f6acbdfaf0ccbb5e48b2bf24f366f16584c660bca4b6b14c048a134bb77a60f6563e","ssdeep":"","tlshash":"02e068ae9391a318537a2dbacc4e060ba0f6114888e5e4e029f5c2c00461bae072bfb4","first_seen":"2024-02-13T14:23:26Z","last_seen":"2026-01-15T12:01:08.184588Z","times_seen":7496,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/site-admin/colors/70f51eeeec8af17958d4b3ed64c17cbb.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.170Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/site-admin/colors/70f51eeeec8af17958d4b3ed64c17cbb.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css\r\ntraceparent: 00-3ee4275fb7ce67c308ca098345993ee6-d3d542bffdeb6fba-01\r\nlast-modified: Tue, 11 Nov 2025 12:08:21 GMT\r\netag: W/\"70f51eeeec8af17958d4b3ed64c17cbb\"\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nexpires: Tue, 11 Nov 2025 14:02:02 GMT\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2613\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:21:18+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":41086,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (41086), with no line terminators","md5":"70f51eeeec8af17958d4b3ed64c17cbb","sha1":"905a3373999b2c0f42305a84cb8adf8ff4c73226","sha256":"d3488c31e569138e379b47eeed95d830fa4f5577464971a5fdc975e2f340ef53","sha512":"2e6445f70f9dca6a39764efe5d680a8b560a0dedbdeadb643f651f0fa319ea6eb96a2b30e7712cde70fdd5b14397ab061d164cf9736f27527d375e7471004093","ssdeep":"384:+EO1mFS775xWt5JkyunibMhS4feInMVXdpeN:+EO1mFS775xWt5JkyunibMhS4mInQpeN","tlshash":"8e037c7ded91c1712a991931d11c677b3d36e9ceae240f8fd02c63e570c1a022be5a7a","first_seen":"2025-11-07T14:05:46.844369Z","last_seen":"2025-11-21T09:37:02.286172Z","times_seen":344,"resource_available":false,"data":null}},"time_used":403,"timings":{"blocked":193,"dns":3,"connect":1,"send":0,"wait":1,"receive":0,"ssl":201},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/Desktop/__shared_css_542ed6.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.176Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/shared-assets/Desktop/__shared_css_542ed6.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css; charset=utf-8\r\ntraceparent: 00-dbadba1e233953579dae5edee9c33a8a-7d557ea535a2d534-01\r\nlast-modified: Fri, 14 Nov 2025 07:59:06 GMT\r\netag: W/\"7eb4f3d4c97ec66a32269ae3b07d7653\"\r\nx-amz-meta-mtime: 1763107046.86426846\r\ncontent-encoding: gzip\r\nexpires: Sat, 15 Nov 2025 08:40:02 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 12289\r\ncache: HIT\r\nx-cached-since: 2025-11-14T08:40:02+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11025,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (11024)","md5":"7eb4f3d4c97ec66a32269ae3b07d7653","sha1":"e31f7fc270a78d455c90a57d8c365bccf6ebdfb0","sha256":"542ed6b44d2771468d5e5d4c77dfddaab1f7d4169bf692a087c56f024d9813dc","sha512":"02195935d732af0ae4dceecb4677bcb4ad90d284dfbd27a707ee927fc587fb3a9bacc8bd8cf315ee025b67d1a53b33fb0e9ced17d24ea019deb2a0be9765ec37","ssdeep":"192:mLhA5ZO73iyDDW7qE/eVgnmnh8RbxJEU4PuiPBvDDQ7qOtIZ4Io:QAXOLisDUqE/Y8RbxUuwBLDCqOt24v","tlshash":"cc3226adc9e495231d26b5216388be7c85f0f06aee314e55f80ec6104ad3f9f15e0e79","first_seen":"2025-08-13T23:36:01.800779Z","last_seen":"2026-03-04T04:00:43.402045Z","times_seen":3922,"resource_available":false,"data":null}},"time_used":475,"timings":{"blocked":232,"dns":3,"connect":4,"send":0,"wait":1,"receive":0,"ssl":232},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.590Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Regular.woff2 HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 63748\r\ntraceparent: 00-957671ce635b84956603ee646d0e22ac-744b51ba67a84adc-01\r\nlast-modified: Wed, 14 Jun 2023 09:49:53 GMT\r\netag: \"6887b6f24414dbc612dbf42ccdc76b70\"\r\nexpires: Thu, 16 Jan 2025 10:32:14 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 632\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:54:19+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":63748,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 63748, version 1.0","md5":"6887b6f24414dbc612dbf42ccdc76b70","sha1":"8068d3abfbc6cbf35b55919da45b1f4d2d136238","sha256":"fc5c015fc32518f1ed810fa84ca28941eb9d5a3c81acc8df69a4dbbeedef7b0c","sha512":"00f08f9dd648972c9571547e06172d5505dd13f577fe2e65a497d3856172807ac11c996984e4138d2eb2ac784257fe61864aee15752fe9e9e76f98db931e0c2a","ssdeep":"1536:KtdCG+Dz6RxAx457zL0ASEn091Y0H1mTOzI/OzMFOoTX4u:MMG+yRpzN091Y0VtI/pOoTt","tlshash":"8b5302485551fae2cac3073c0f7a89dbb37a776d519224cd98b69f830d37964bea2070","first_seen":"2023-06-14T19:15:49Z","last_seen":"2026-04-04T17:39:02.503075Z","times_seen":10298,"resource_available":false,"data":null}},"time_used":4,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/vendors/plugins.vue-notification-5b390c43.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.014Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/vendors/plugins.vue-notification-5b390c43.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-5c8d083bcc05f8ac99efc6547204208a-c8499bd09b2fe2c9-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:01 GMT\r\netag: W/\"4b1ff7688640c01809e28779569b7ff5\"\r\nx-amz-meta-mtime: 1762953359.767534222\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:32 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.001\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81267\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:30:25+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12563,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (12563), with no line terminators","md5":"4b1ff7688640c01809e28779569b7ff5","sha1":"87ae5ac01471e3fbff903c1c7b419e003827d067","sha256":"5b15b063f36c4eabab028e4a6139680d508847b31968304172243614c710cd3d","sha512":"b0f2730c2b700899afb7fd513c0c9984f10553ea7e6c83d4600bd4c5b505351f2f1306840ec6072c779383ab0941b063ba3794c59494c19ac81069d86776dc99","ssdeep":"192:3U1hQXHv3CbfKpqEVwhSIkrReP+SdHtfGA2D3ow5EE9bJ52bFZLy2mp4ilVj:3n3CmpcDkAP+S/fGAWf5VbWbLy2mmijj","tlshash":"b04296ceb2c2b4650be760b6402f110af136a96869ab54d4f3b1d4f2adb564c413bf3d","first_seen":"2025-11-06T10:58:42.382403Z","last_seen":"2025-11-20T09:36:24.069268Z","times_seen":344,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_main/en/dictionary_19f216df27a57e272fbf37c0721aeeae.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/web-app-v2/dictionary2/v3_main/en/dictionary_19f216df27a57e272fbf37c0721aeeae.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json; charset=utf-8\r\ntraceparent: 00-9d243bed118e274c6edb07b24bb0237e-5d52f6b0c0bf5b47-01\r\nlast-modified: Wed, 12 Nov 2025 18:07:58 GMT\r\netag: W/\"174e63c79a247999acabc50b211d2839\"\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nexpires: Wed, 12 Nov 2025 19:22:36 GMT\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2129\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:29:23+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":146971,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"174e63c79a247999acabc50b211d2839","sha1":"85e713780b233c79d52eec60dbabaa04086ee13d","sha256":"2c8439bf593da7229657fddceb876f1d654c0421849bc8d7c3849e0a313e576b","sha512":"16ee19c0685be080a63da989a121926fed4e05466e6c6c83410f839c173638323cd0ace016a8d243e85ccabb116c98f37303d0687cc246808ff662210541aec2","ssdeep":"3072:vk+H53YMI9Z0rkk7etAfRxxlRVPWE+AQLbnMc6WrJuRfuJm9pHZ4:vBIsoJ2fVlRVPWE+Fbnz8fuJm9J+","tlshash":"81e3e80a194c6e7b0fda22ddf94fdf4962b00055aab2c822d8eec51e7197fd2817714b","first_seen":"2025-11-12T20:53:26.28408Z","last_seen":"2025-11-16T10:41:26.751758Z","times_seen":101,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-1103/desktop/media_asset/356c384ab8ea74fc9c238a4192006816.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:53.038Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-1103/desktop/media_asset/356c384ab8ea74fc9c238a4192006816.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:53 GMT\r\ncontent-type: application/json\r\ntraceparent: 00-c9c21fa6b34fc8bf080ab5798d1e7538-d0b92441601fd498-01\r\nlast-modified: Tue, 28 Oct 2025 08:33:52 GMT\r\netag: W/\"8ba5272de1a0d518402fa328c33804e6\"\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 14:15:28 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\ncache: REVALIDATED\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1712,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"8ba5272de1a0d518402fa328c33804e6","sha1":"ab5afbda12337a29c4862b2b19cdb9e9f53154cb","sha256":"6f70a82334d9f5801ceb19d6356a63792a31ab3aac81cf31644adc806a873c81","sha512":"54797cc0ec8ca9502adea2c128a59c738f56b9734768003e137a3bce13d81eb8eddc055f072e5c445907f5d4d28bbfc8896557bbf241645915938f0c2e3492b3","ssdeep":"","tlshash":"bc31c695fbe06cb3303f90ad99b7b50ed3880f13ad56ac54baac394c2b54516006ad3f","first_seen":"2025-10-28T08:50:41.526031Z","last_seen":"2025-12-24T07:52:07.872206Z","times_seen":1298,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/b6acb55799.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:53.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/sys-technical-pages-app-static/Desktop/Default/b6acb55799.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:53 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-eba98791ca887da39a3aa158ecf7ddb8-2ca46b955a282885-01\r\nlast-modified: Wed, 12 Nov 2025 14:02:13 GMT\r\netag: W/\"b9ab6ec44d87be362410f03d2ee0d6b9\"\r\nx-amz-meta-mtime: 1762956023.84127423\r\ncontent-encoding: gzip\r\nexpires: Fri, 14 Nov 2025 14:51:03 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 76430\r\ncache: HIT\r\nx-cached-since: 2025-11-13T14:51:03+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3359,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3358)","md5":"b9ab6ec44d87be362410f03d2ee0d6b9","sha1":"22fa4421d3aaf716bc315ee30caf1aa4870256b5","sha256":"79f0d616500808f0902080b83341d1f88ee74622d861da96ada967410ace0ffa","sha512":"ebd2416b256b72c117dc7daf94746ad2e04bb1e9fd0043fae0436c33f41d3e335e0c03c44d77cd92076e31e68a063de5828460054fbfa8a68bfa1822099d9dfe","ssdeep":"","tlshash":"0e617442ac74e6fafa1794143d1354a0d71f9c7ed1208ae8e2b4c8ec269c5926832e47","first_seen":"2025-11-13T15:27:51.591126Z","last_seen":"2025-11-20T10:41:57.653526Z","times_seen":142,"resource_available":true,"data":null}},"time_used":3,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:01.294Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1/desktop/fonts/Roboto/Roboto-Bold.woff2 HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:01 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 63920\r\ntraceparent: 00-c1df16b0d5ae3ea91800be2a7fa59920-9de3e1c863a77225-01\r\nlast-modified: Wed, 14 Jun 2023 09:49:53 GMT\r\netag: \"a65527fcb58f66a7cfbc0e6b160538b4\"\r\nexpires: Sun, 10 Aug 2025 19:21:26 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 3358\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:09:03+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":63920,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 63920, version 1.0","md5":"a65527fcb58f66a7cfbc0e6b160538b4","sha1":"45d260e7fa343401b5bb0df982a014f53e2d253b","sha256":"fb13c3a1cbac60649b76f7d7f85c1645d35ac69b85ce5f4eb0692505ecc2cd45","sha512":"8448e96abe326f43285b2d8b0d75beaf0e9c9e051e8754841d907b30eb303ae24c447011306da6a1703b9192d02aeff76a4517bdf94ec6e7dc360ce3538802af","ssdeep":"1536:UIG3hJMkJeK8ic5iZGnJ4URj9vqXOQ6UqYdbuA5RVK1:UL31hcLlRjDQ6Uq4W1","tlshash":"7f5302df8de32a148ff78772668885f4f4927c68898c8e7345526a8907f07d6b96c04f","first_seen":"2023-05-07T18:04:27Z","last_seen":"2026-04-04T17:39:02.424617Z","times_seen":10176,"resource_available":false,"data":null}},"time_used":6,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":4,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/css/13382faf.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.183Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/css/13382faf.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css; charset=utf-8\r\ntraceparent: 00-23e56fb42cad19145c15153e36dd6a44-83cd16d2fd0d86e8-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:01 GMT\r\netag: W/\"522bed13bfb021f11f9100e2f5a2fa88\"\r\nx-amz-meta-mtime: 1762953359.753534178\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:31 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81303\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:29:48+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15193,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (15193), with no line terminators","md5":"522bed13bfb021f11f9100e2f5a2fa88","sha1":"e35753a7f9434702331a022a65fea710096f73ed","sha256":"0c09117600e3f9a9377db07f0a4e5f78ff1a2f8ab3cef75d04640ce229032d22","sha512":"dbc706017a1281f67cd28689755365d1ec1e52a9efd00bf367b97892c71f8c96eeceb078a274b0c5dfa5acb405c4d12e5c3594022c1b126e0195329dd0fb3b00","ssdeep":"192:HOIOH7nvxxxY4lctZLJh6N0dtu8yvrs9lvhvuvoQwltoQrNTC4cjWnk3LbBQ:HCJxxY4MJJqJQr9C4GWk3PBQ","tlshash":"1362b61fd53692b21d238c52728ebf383539722628a65735f44e26488ddbb9703d0fb8","first_seen":"2025-09-30T10:36:50.754445Z","last_seen":"2025-12-02T07:51:56.02009Z","times_seen":2313,"resource_available":false,"data":null}},"time_used":35,"timings":{"blocked":32,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-1103/desktop/media_asset/ad4c234c880e89b62886bd43b2adf7be.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-1103/desktop/media_asset/ad4c234c880e89b62886bd43b2adf7be.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ntraceparent: 00-200bfc3d3dcc8a3a81959124b4822027-9562561609a0c907-01\r\nlast-modified: Fri, 14 Nov 2025 11:56:21 GMT\r\netag: W/\"96176e53f537e811b24182283e52dfef\"\r\ncontent-encoding: gzip\r\nexpires: Fri, 14 Nov 2025 13:04:52 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\ncache: MISS\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14724,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"96176e53f537e811b24182283e52dfef","sha1":"a2a8fcc2a27a0d5fd455a228a473b5bd3ad8e274","sha256":"93b4903f9123e9b95d9cd7d21c1707286f6f5ba188a40a51e1c880cf6dc06dd8","sha512":"2a23a55f20d1880715cde7283c50c37faaf9990aca368f4fdbe528b6a39bfc8fafb7a7ac744b265248fe038842cc539cb866c6cbaa388f4aa6f4cebbf787b4db","ssdeep":"96:75b7Ba79eu4QWGAdryCiQFpzLJLJeHZVZYpH3UGHSTSSbbGiJinHQU:u7kJ2VK3UsyinHQU","tlshash":"7e624799bae41c33112b60bed5f7f91aa3cc1f479d4aa8287e9c6d4c1b6050500aed7e","first_seen":"2025-11-14T12:05:26.807089Z","last_seen":"2025-11-14T12:05:26.807089Z","times_seen":1,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_popper_js_WZJKYEQD.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/shared-assets/__shared_popper_js_WZJKYEQD.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-f7b084ec2fdabcb8c3a947eceb11faaa-768a891372abd970-01\r\nlast-modified: Fri, 14 Nov 2025 11:15:39 GMT\r\netag: W/\"bea5b052c307601192270938523fa030\"\r\nx-amz-meta-mtime: 1763118064.652528921\r\ncontent-encoding: gzip\r\nexpires: Sat, 15 Nov 2025 11:45:01 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 1191\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:45:01+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21252,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (21232)","md5":"bea5b052c307601192270938523fa030","sha1":"937f7094c67f5a92c1032a7bc3f21ee94bec66ef","sha256":"f41290374ba615854ebb4b28a07de775581707f3b6427bcc01c0529c62476f64","sha512":"b9bff7f7d9b518ec76898a732114873c01206378c2a840c62062f05487ef773716ce841d7a5bafe3f0c65fbfdf05509852571a3a6b381661cb6f4984d6bc23a9","ssdeep":"384:ZP7iayBuR9vu3z1JXvykd2+LaqHdC6RjVnTGm/7piCXmH8kCCcvJTCyCu+meAxiZ:piZwO3XvO+NMSJt3XmckXcv4nxJAxiH5","tlshash":"7b92a28c7684b0a287a7a2a7a07f860f71376865650e9004f59cf6ec3c35dba507bc7d","first_seen":"2025-08-22T10:11:14.555802Z","last_seen":"2026-03-04T04:00:43.408775Z","times_seen":3920,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/bff-api/config/group/get?groups=d.technical\u0026lang=en","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /bff-api/config/group/get?groups=d.technical\u0026lang=en HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\ncontent-type: application/json\r\nx-requested-with: XMLHttpRequest\r\nis-srv: false\r\nx-svc-source: __TECHNICAL_PAGES_APP__\r\nx-app-n: __TECHNICAL_PAGES_APP__\r\nx-geoip2-country-code: ru\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; postback_watcher=; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1920; che_g=22b78b6c-0d92-4b18-a655-a4392ed48553\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 752\r\ncache-control: no-cache, private\r\nserver-timing: dt_total;dur=0.088, bff;dur=79.29, wf-uht;dur=0.165\r\nx-dt: 1103\r\nx-pod: R-8d6m5\r\nx-time-ng: 0.154\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":752,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b732d3c50aadb564cf331c30d7645823","sha1":"9cc394e53873d519eb9145294e838c95862ad48c","sha256":"88447c2a975e263e4fe7423d44cf4e30930f1aed4037172806f71e54d8586bd6","sha512":"11ae84c91dedf66a15430719fb21371da0ee9d612f4c95b4e06c2aa42053e718f6b6859736c6855a98cdb9ad490566c71d4860883970f354765b902f7cf1fa20","ssdeep":"","tlshash":"7301885e00a5ca3d706c063adb865e109eed401b3254b951fe0cec9c60d6cdef95580f","first_seen":"2025-11-09T20:45:21.70552Z","last_seen":"2025-11-23T15:33:15.749545Z","times_seen":9,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"region1.analytics.google.com/g/collect?v=2\u0026tid=G-7JGWL9SV66\u0026gtm=45je5bc1v897130004za200zd897130004\u0026_p=1763121902306\u0026em=tv.1~em.jbq2QQSrO2ikY9LnpEhc3gb8Lbs4VVpt1DA_r0B_BRM\u0026_gaz=1\u0026gcd=13l3lPl2l1l1\u0026npa=1\u0026dma_cps=syphamo\u0026dma=1\u0026cid=590871141.1763121903\u0026ecid=1693062177\u0026ul=en-us\u0026sr=1280x1024\u0026frm=0\u0026pscdl=noapi\u0026ec_mode=a\u0026_s=2\u0026tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115495938~115583767~115616985~115938466~115938469~116217636~116217638~116474636\u0026sid=1763121902\u0026sct=1\u0026seg=0\u0026dl=https%3A%2F%2F1xlite-837593.top%2Fen%2Fblock\u0026dt=1xBet\u0026en=page_view\u0026_fv=1\u0026_nsi=1\u0026_ss=1\u0026_ee=1\u0026ep.optimize_id=GTM-5R4MT54\u0026tfd=13055","fqdn":"region1.analytics.google.com","domain":"google.com","tld":"com"},"ip":{"addr":"216.239.34.36","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:02.788Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.google-analytics.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Oct 2025 08:37:33 GMT","end":"Mon, 05 Jan 2026 08:37:32 GMT"},"fingerprint":{"sha1":"6D:B1:20:6C:4E:45:23:88:91:95:5C:C3:FE:0D:A8:1B:29:43:20:6A","sha256":"15:E2:87:29:F5:07:FE:12:A2:58:8F:EE:D0:AD:2A:AC:63:5D:69:08:82:23:F9:BD:90:70:9F:09:AA:7B:57:8B"}}},"request":{"raw":"POST /g/collect?v=2\u0026tid=G-7JGWL9SV66\u0026gtm=45je5bc1v897130004za200zd897130004\u0026_p=1763121902306\u0026em=tv.1~em.jbq2QQSrO2ikY9LnpEhc3gb8Lbs4VVpt1DA_r0B_BRM\u0026_gaz=1\u0026gcd=13l3lPl2l1l1\u0026npa=1\u0026dma_cps=syphamo\u0026dma=1\u0026cid=590871141.1763121903\u0026ecid=1693062177\u0026ul=en-us\u0026sr=1280x1024\u0026frm=0\u0026pscdl=noapi\u0026ec_mode=a\u0026_s=2\u0026tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115495938~115583767~115616985~115938466~115938469~116217636~116217638~116474636\u0026sid=1763121902\u0026sct=1\u0026seg=0\u0026dl=https%3A%2F%2F1xlite-837593.top%2Fen%2Fblock\u0026dt=1xBet\u0026en=page_view\u0026_fv=1\u0026_nsi=1\u0026_ss=1\u0026_ee=1\u0026ep.optimize_id=GTM-5R4MT54\u0026tfd=13055 HTTP/1.1\r\nHost: region1.analytics.google.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\naccess-control-allow-origin: https://1xlite-837593.top\r\ndate: Fri, 14 Nov 2025 12:05:02 GMT\r\npragma: no-cache\r\nexpires: Fri, 01 Jan 1990 00:00:00 GMT\r\ncache-control: no-cache, no-store, must-revalidate\r\naccess-control-allow-credentials: true\r\ncontent-type: text/plain\r\ncross-origin-resource-policy: cross-origin\r\ncontent-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:164:0\r\ncross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:164:0\r\nreport-to: {\"group\":\"ascnsrsggc:164:0\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:164:0\"}],}\r\nserver: Golfe2\r\ncontent-length: 0\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T18:47:00.89111Z","times_seen":13342615,"resource_available":true,"data":null}},"time_used":143,"timings":{"blocked":62,"dns":0,"connect":20,"send":0,"wait":18,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/vendors/plugins.v-tooltip-94e994cb.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.989Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/vendors/plugins.v-tooltip-94e994cb.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-68c709b0d67ef61af0a83114cc9d6e96-dd4ee78607363bf1-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:01 GMT\r\netag: W/\"eb625cecc3515eeeed288a4a848a1370\"\r\nx-amz-meta-mtime: 1762953359.767534222\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:32 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81266\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:30:25+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":76773,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65476)","md5":"eb625cecc3515eeeed288a4a848a1370","sha1":"03983653e03d252b6c25c7ab181fcfc9627a015b","sha256":"59b3023a857b625069fc6ace89a0f1b1b8d1eea60418936a9f74d17f13b9bdb2","sha512":"352876c626d8c71a1440efa6e34f94ed31f4a49ff6813f9f27c87e719bc817fdd46fa1fc336851d9fd567080527199e93397a262e560ce516b39b8ad66700348","ssdeep":"768:xpVQJyG0t6uTbwLWMZI+7tSCUC8Lk7t8R6zk+BaNfSby/Qw/H/g57bh0PGBwrWdC:xpeJX0QuALTPRSCv1MHrWdRfm57EY","tlshash":"ad73b68e7394f0b203e7b175413f620fb2776558a40ae014b2b1e5d4ac3da5aa277e3d","first_seen":"2025-11-06T10:58:42.387819Z","last_seen":"2025-11-20T09:36:24.054652Z","times_seen":344,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/web-app-v2/dictionary2/v3_block_pages/en/dictionary_3ef94734ec45ea2c0f503f7832132a49.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:53.035Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/web-app-v2/dictionary2/v3_block_pages/en/dictionary_3ef94734ec45ea2c0f503f7832132a49.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:53 GMT\r\ncontent-type: application/json; charset=utf-8\r\ntraceparent: 00-0a437114ee57a4a2bdf2075cb6d758b8-17e410332b48c9bf-01\r\nlast-modified: Mon, 03 Nov 2025 18:07:37 GMT\r\netag: W/\"69e77af8cde2a7cd904617784615a4c5\"\r\ncache-control: max-age=3600\r\ncontent-encoding: gzip\r\nexpires: Mon, 03 Nov 2025 19:20:14 GMT\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2972\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:15:21+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2554,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"69e77af8cde2a7cd904617784615a4c5","sha1":"9a49311afa83398c939fa0a375a2852252bb322f","sha256":"dd4312f4391806895c44f3747b198df214e56c263f8ce789e1495162871cda4d","sha512":"5a341072c1bf0daf154f3626489425645789e80a7f2357272ae7272b74a7e5a5b130754ccf36769a09c42dd60e59e1cfd9ac6fcfb5b5af25a0d5d81fa3aef282","ssdeep":"","tlshash":"8451611f733c45e5393841803e0daeaa7b120268af916194fa8cd85d332f8c9e13762f","first_seen":"2025-11-03T18:36:28.530943Z","last_seen":"2025-12-08T14:35:26.743341Z","times_seen":855,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/css/0dfa59b1.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/css/0dfa59b1.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/css; charset=utf-8\r\ntraceparent: 00-0c7943d735abb68a5cd6d88d299197e6-7cb284b83a30e5e0-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:01 GMT\r\netag: W/\"0da56ca3f55073052d5f3d2460d32ba8\"\r\nx-amz-meta-mtime: 1762953359.753534178\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:31 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81303\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:29:48+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41529,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (41529), with no line terminators","md5":"0da56ca3f55073052d5f3d2460d32ba8","sha1":"6f513e58994014cebf7b8f820d147b2eda4b3f5a","sha256":"151d829c50a8b70bffda3fc632ca06f5ab5e300641016691d7c5b6e591835432","sha512":"bc46f1271b323d65bbaf1700eed1e012ac5d8b22cf4abe0fe6db8d1f7dbad63cd802eb06a8abeba67f06e4bf23137cfefe9442eea1e1655836949437236b6c60","ssdeep":"768:SnraFC/9ApQze5jsZ/aWVXuNVuvLh0TEAhZMs7XQzX8:erYC/9ApQzOM/aW+","tlshash":"9b13015dfca4d1760d2bf521a388ae3c01b0f42ade314d96f90e57a518c3f9b15e0ea9","first_seen":"2025-11-12T13:10:30.956181Z","last_seen":"2025-11-27T10:38:20.781143Z","times_seen":354,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":30,"dns":0,"connect":0,"send":0,"wait":3,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/vendors/app-efd67d7a.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:51.638Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/vendors/app-efd67d7a.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:51 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-3f06ef94b986f94d459641f6c2e37293-bba005cb8109a262-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:01 GMT\r\netag: W/\"25d6eda502ccfab2b9cb920949ad873d\"\r\nx-amz-meta-mtime: 1762953359.765534216\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:31 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81303\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:29:48+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":963291,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64585)","md5":"25d6eda502ccfab2b9cb920949ad873d","sha1":"b9a42a825e34ce132152eaed28bcf600c4f08438","sha256":"d7bb46de616b2461894991083c4cf1c8bcf9d5c5e957b75640be28d975a59975","sha512":"f2b0f9aece401adfa0adcc2a322191638cfb1d7d6fa9304a4c4b2194f647b7c4aa454ca9fd8ebc0126b99a479f332aede17da0156cd1876862468771e157cd07","ssdeep":"12288:LdQX/yYLwdkjexY4g1/SDlLioPu5VzYg3xWdep7D:eX/yY8dkjexY4g1/SX25usxW4p7D","tlshash":"56254b69b981f2560aa36ae9c06b0057e33d6f1eac0cd454f2e7cdd5395a804713bb2f","first_seen":"2025-11-12T13:10:30.963396Z","last_seen":"2025-11-20T09:36:24.065196Z","times_seen":167,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/css/7fe5f71b.css","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/css/7fe5f71b.css HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/css; charset=utf-8\r\ntraceparent: 00-14c4a5a87dbc5b069c097c7a2cb8164e-d281599b3dc09535-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:01 GMT\r\netag: W/\"c610b8710368de3bf2f1c5bb581b6a3a\"\r\nx-amz-meta-mtime: 1762953359.7605342\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:32 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.002\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81267\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:30:25+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3313,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (3313), with no line terminators","md5":"c610b8710368de3bf2f1c5bb581b6a3a","sha1":"f67bc86785d434adb2e81a356a7926b8818ac567","sha256":"fad7111846310042401990719146401178f22e2618abf2b058e641b6495e8eba","sha512":"2dfecbd28b59bcf4b361736ce304f33792631b766506b80767f23033cbd37c1a83371af59b833032390f647b69824e9eeeb1f99530e18047f74cd30ffda0e5b1","ssdeep":"","tlshash":"0161c13e9cbc24359e7f472b7053ce84e199a39092030f8afdbb755a4c8b21d3895176","first_seen":"2024-05-14T21:30:49Z","last_seen":"2026-01-22T06:40:31.190981Z","times_seen":5786,"resource_available":false,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-1103/desktop/media_asset/12f048aabdb84ec521c0ccd1780e1dee.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-1103/desktop/media_asset/12f048aabdb84ec521c0ccd1780e1dee.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ntraceparent: 00-5b0566b412929cd2129896b41d856be7-9a896349b782ec79-01\r\nlast-modified: Sat, 01 Nov 2025 11:53:55 GMT\r\netag: W/\"ca44b431a5f69145e846cbfe74198e27\"\r\ncontent-encoding: gzip\r\nexpires: Sun, 09 Nov 2025 21:47:07 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\ncache: REVALIDATED\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27644,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ca44b431a5f69145e846cbfe74198e27","sha1":"a03bbccd69b5763a608e8cf562d1563e93fbc68c","sha256":"0b8c748a59b373b686dd0aff27eb1de1ecc39401b0393772118058123ce4b462","sha512":"47b38a7a4a41cf7243f641ef274078a3e5c632af1d994f009e8b2afd944cdecebc5650717660d2d03b0611b080e685ac7bcc1c714918bc90f343dd285aaec4dc","ssdeep":"384:hrLr0fLPwUj+uZbC445IOhT9TYXw1LyaN1C1WjTZ5sogvlQrLg9sKHdFVb:hvkD+yEgvarUVb","tlshash":"e3c24a85fef40c33202f90ae95f3b90e93d85f87990a6c14bfad2a4d2b54519016bd7e","first_seen":"2025-11-01T15:13:39.989413Z","last_seen":"2025-11-18T07:01:34.616914Z","times_seen":422,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/main-static/88f30c11/desktop/default/DC-bfe7727f.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.221Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /main-static/88f30c11/desktop/default/DC-bfe7727f.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ntraceparent: 00-eabda86f03711e99ad7c5b13b3b4f2a7-467d188781c412f1-01\r\nlast-modified: Wed, 12 Nov 2025 13:16:00 GMT\r\netag: W/\"e240aa2b7ff14a3003f4a6843189ab6f\"\r\nx-amz-meta-mtime: 1762953359.729534103\r\ncontent-encoding: gzip\r\nexpires: Thu, 13 Nov 2025 13:27:33 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.001\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 81267\r\ncache: HIT\r\nx-cached-since: 2025-11-13T13:30:25+00:00\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2201,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2201), with no line terminators","md5":"e240aa2b7ff14a3003f4a6843189ab6f","sha1":"1e41ba3e26e1a4f61230d02ab9cc36afa191182c","sha256":"3628a16803a7a09374ac72510704adc88d30ac65d0e11cdaec862cc61da9119e","sha512":"8dc37587cf244e27ef5e19682cd8059610e0dfeaf9485c14e1ad6dc3e063a99ee8f00ebffd826ae80f508bf7400b8f8d70cc75555ee2ca971810e7f8ee8d12dd","ssdeep":"","tlshash":"b241a40931a4fc11d3f90cd86dff7206102bf076648dc9b4d3a32a8b08b7f6aa217916","first_seen":"2025-11-06T10:58:42.372215Z","last_seen":"2025-11-20T09:36:24.066302Z","times_seen":344,"resource_available":true,"data":null}},"time_used":1,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/genfiles/cms/1-1103/desktop/media_asset/2252108128bc1cc1783a0a1544f820ad.json","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:53.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /genfiles/cms/1-1103/desktop/media_asset/2252108128bc1cc1783a0a1544f820ad.json HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:53 GMT\r\ncontent-type: application/json\r\ntraceparent: 00-b9ec09295e07d2abc65fb8523b1e4289-3598673992999fe5-01\r\nlast-modified: Fri, 19 Sep 2025 14:23:05 GMT\r\netag: W/\"b5a6dbdf3f12e11d0c5275b2ca6dc739\"\r\ncontent-encoding: gzip\r\nexpires: Sun, 09 Nov 2025 21:47:08 GMT\r\ncache-control: max-age=3600\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\ncache: REVALIDATED\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3091,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b5a6dbdf3f12e11d0c5275b2ca6dc739","sha1":"a8495df42a8f1e18c12dc1723660d062bbc8fb6b","sha256":"8febfd79d9b9b1298af34575340a4288d6d5b01ee4e50c57f5a5509d602412f2","sha512":"813327003eefeef8e9772adc05530b46f52fc044d76f5ed1393854052836ae2f89a0118697367681afbab9084b4e215c3120bf09ea2713553a7e8286ca9afe2d","ssdeep":"","tlshash":"85514b4df6e41c33012f19bdc0f76a6993d84f4f694a7c283a9d6c4d1bd451900aad3e","first_seen":"2025-07-21T03:11:29.13175Z","last_seen":"2026-01-11T03:06:49.449217Z","times_seen":2816,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/sys-technical-pages-app-static/Desktop/Default/5fa576b302.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:53.086Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/sys-technical-pages-app-static/Desktop/Default/5fa576b302.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:53 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 737\r\ntraceparent: 00-bcb58754bb31eda33ce0e7b045eb8da2-f225981512511746-01\r\nlast-modified: Wed, 12 Nov 2025 14:02:14 GMT\r\netag: \"8bef143b1a40291055ba9511b0e5bf42\"\r\nx-amz-meta-mtime: 1762956023.84127423\r\nexpires: Fri, 14 Nov 2025 11:17:02 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 2635\r\ncache: HIT\r\nx-cached-since: 2025-11-14T11:20:58+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":737,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (734)","md5":"8bef143b1a40291055ba9511b0e5bf42","sha1":"5f4f50ddb6c59c51d71de57769b6e8db7d729754","sha256":"bd785da9def2b0cd40e1a9eb2c97ae8a09d6a72477a98371ba7c6fc1653914de","sha512":"3484f59803d2cb15c70a3eb3f670ace59e7f8b5c1d91d66d384bbe169400c117fad8af401b5f7847c36d0a58dc5bff6f52a18e6590fa1accf15cee039e47128b","ssdeep":"","tlshash":"180110a930b29188a5eb49cebd24103ad7781a42370a5cf5f7dd86b3509a18255ab886","first_seen":"2025-11-12T13:10:30.968774Z","last_seen":"2025-11-20T10:41:57.623285Z","times_seen":168,"resource_available":true,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":3,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/web-api/session","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:00.271Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /web-api/session HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\ncontent-type: application/json\r\nx-requested-with: XMLHttpRequest\r\nx-app-n: v3-nuxt2\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1280; che_g=22b78b6c-0d92-4b18-a655-a4392ed48553\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:00 GMT\r\ncache-control: no-cache, private\r\nserver-timing: dt_total;dur=0.094, p;dur=11.175, wf-uht;dur=0.025\r\nset-cookie: ua=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/\nSESSION=13033e2b8d7c5d02143e1c584c11d481; path=/; secure; httponly; samesite=lax\r\nx-dt: 1103\r\nx-time-ng: 0.013, 0.014\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-04-04T18:47:00.89111Z","times_seen":13342615,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":52,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.288Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"POST /fatman-api/a6f69e4388362d761ee5bb073edb23ae3d9341fb/event.json HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://1xlite-837593.top/en/block\r\nContent-Type: application/json\r\nX-Lang: en\r\nX-Uuid: c859b9ae-2f21-4c2d-9754-c161720a7554\r\nContent-Length: 90\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; postback_watcher=; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1280; che_g=22b78b6c-0d92-4b18-a655-a4392ed48553\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: application/json\r\ncontent-length: 23\r\nx-dt: 1103\r\nx-time-ng: 0.007\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.010, wf-uht;dur=0.028\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"526dd67a7b25ce344f60d188cb23456b","sha1":"f865d87ba39297fc03228e59dd1adf268ae0f702","sha256":"9f8e93d542818dc2733b537d09d910a4f7cc9018b7e6017d2867896f37fa2666","sha512":"128c91bf51356901ffe542ec3b3c1968470aa567ef456cb4d4c52756f5df22edf870cd9d9e3a4e76db8aa60d2d6b1e8d9ff4781f529433b940a0e77a77f97fa4","ssdeep":"","tlshash":"f8700000202a20c08208c0020a8088000e30a0020800002200c08203a220cf0880f203","first_seen":"2025-11-14T12:05:26.817591Z","last_seen":"2025-11-14T12:05:26.817591Z","times_seen":1,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":55,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"v3.traincdn.com/sys-static/shared-assets/__shared_fast_deep_equal_RNYYWXHZ.js","fqdn":"v3.traincdn.com","domain":"traincdn.com","tld":"com"},"ip":{"addr":"185.244.209.62","port":443,"asn":199524,"as":"G-Core Labs S.A.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:04:52.589Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.traincdn.com","organization":""},"issuer":{"commonName":"Sectigo RSA Domain Validation Secure Server CA","organization":"Sectigo Limited"},"validity":{"start":"Tue, 26 Nov 2024 00:00:00 GMT","end":"Fri, 26 Dec 2025 23:59:59 GMT"},"fingerprint":{"sha1":"71:CC:F4:85:58:3C:F4:8C:55:97:B4:2F:47:54:D1:16:BE:D5:A3:CA","sha256":"25:0D:BA:0E:61:92:06:3D:A5:AC:35:E6:49:CB:32:10:0C:93:21:05:99:95:91:80:04:2F:A7:FF:E2:E7:5B:C4"}}},"request":{"raw":"GET /sys-static/shared-assets/__shared_fast_deep_equal_RNYYWXHZ.js HTTP/1.1\r\nHost: v3.traincdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://1xlite-837593.top\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://v3.traincdn.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:04:52 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 865\r\ntraceparent: 00-f1e4ee8f6a8371db8edad4a9c7d8523c-beed4f5d6f09e045-01\r\nlast-modified: Thu, 13 Nov 2025 13:41:32 GMT\r\netag: \"00e44cad05af09626c2b10aeee7de5a3\"\r\nx-amz-meta-mtime: 1763041217.785518655\r\nexpires: Sat, 15 Nov 2025 05:38:43 GMT\r\ncache-control: max-age=86400\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\nx-id: osix-hw-edge-gc4\r\nage: 23169\r\ncache: HIT\r\nx-cached-since: 2025-11-14T05:38:43+00:00\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":865,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (840)","md5":"00e44cad05af09626c2b10aeee7de5a3","sha1":"4461fd05cdd85255f4ab24edd5ac80e7b6dec92e","sha256":"5277a86b8db312b1e34318cb994829e113d8204c3a2e88ab594e5135b2bbfb2a","sha512":"548bf615b1118881d21a0cfd2d530b3f0ce1e14cc93cb6afce662b30ac70877fa152fd71b5d786bb2e43e31a1980e00b83106b1f4b3ae12fbb2ddbedf6c81841","ssdeep":"","tlshash":"901159c232e3a0d183e058cd1001d906f23969e9a4bca0c9c757e6b93cb2a53d87672a","first_seen":"2025-08-22T10:11:14.567955Z","last_seen":"2026-03-04T04:00:43.420123Z","times_seen":3921,"resource_available":true,"data":null}},"time_used":2,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"1xlite-837593.top/hd-api/external/assets/hdf.js","fqdn":"1xlite-837593.top","domain":"1xlite-837593.top","tld":"top"},"ip":{"addr":"83.147.224.159","port":443,"asn":0,"as":"","country":"Iran","country_code":"IR"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://1xlite-837593.top/en/block","date":"2025-11-14T12:05:00.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"1xlite-837593.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 05:23:05 GMT","end":"Sun, 28 Dec 2025 05:23:04 GMT"},"fingerprint":{"sha1":"9D:2D:24:91:6D:00:47:FA:D6:CF:48:1C:13:03:FE:06:AB:40:11:F2","sha256":"25:B4:A5:BD:40:B2:1A:64:4C:31:15:FB:E3:F7:24:E9:03:A9:05:C7:44:D5:F8:4D:E4:67:09:96:09:99:66:95"}}},"request":{"raw":"GET /hd-api/external/assets/hdf.js HTTP/1.1\r\nHost: 1xlite-837593.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://1xlite-837593.top/en/block\r\nCookie: platform_type=desktop; gw-blk=eyJkYXRhIjp7ImlkIjoyMjk0LCJkaXNwbGF5VHlwZUlkIjoxLCJ0ZW1wbGF0ZVR5cGVJZCI6MSwidGVtcGxhdGVJZCI6MX0sImJyZWFkY3J1bWJzIjpbMSwxMiwxNCwxNSw4ODUsMjMyMiwxNiwyNTA5LDQ5NSw4MTIsOTg1LDgxMywxNywxOCwyMTg2LDIzNjgsMjMwMCwyMzc2LDg0NiwyMjY3LDIyOTEsMjMwMywyMzc1LDgxMCw5NDQsMjIxMSwyNDA5LDI0OTUsMjUxOSwxMDkwLDEwOTMsMjE5MSwyNTAwLDEwMDIsMjI0MiwyMzAxLDI0NjEsMjQ2NCwyNDY1LDI0NjIsMjQ2NiwyMjU2LDIyNTEsMjI4NywyNDMyLDI0NzgsMjM0NSw0ODQsMzk1LDIzMjgsMjQwMiwyMzMyLDQ3NCw0NzYsMTAwNiwyMzk0LDI1MTgsMjM2NiwyNDAzLDIzMTEsMjUxNiw4MDksOTEyLDgwNiwyNTE1LDc4Niw3NjgsNzc1LDc2Nyw3NjYsNzUxLDI0MjQsMTAzOSwyMzI3LDI0MjIsMjQ2OCw5MDcsOTg0LDExMDYsMjQwOCwyMzA3LDIxNTUsMjM3MiwxMTE5LDIyOTYsMjM1NCwyMzQwLDk2OCwyMjI5LDIzOTIsMjQzMSwyNDEzLDI0MzQsMTA5NiwyMzUxLDc1OSwyMjI4LDIyMTQsODQzLDg0MiwyMzUyLDc1Niw3NDcsNzQ4LDU0OCwyMzUzLDI0MjUsMjQyNiwyNDczLDI0OTIsNzg3LDI0NDYsMjE2Myw4MzksNzgzLDI0NzcsNTI1LDI1MTMsMjQ4MCwyNDM5LDI0NDAsMjUwNyw1MjQsMTA3NSwyNDE2LDEwNzQsNTQ5LDk0Myw1MTIsMTExNywxMTAxLDEwNzMsMjMxMCwyMzk3LDI0NjMsMjQ1MiwyMzc4LDIzODgsMjM4OSwyMzk2LDI0MDcsMjQxMCwyNDEyLDI0MTgsMjQyMCwyNDc1LDI0MjgsMjQzNSwyNDY3LDI0NTEsMjQyMywyMzY5LDEwNzgsMjQzNywxMTAwLDI0MzYsMjUxMSwyNDI5LDI1MTQsMTAxOSw1MTUsNTIyLDc2OSw0NzUsNTQ1LDgxNSw4MTcsMjQ1NiwyNTAxLDI1MDgsNDc3LDQ5OCw5NDIsMjMyMCwyMjg5LDIyODAsMTA4Niw5NzgsMTA4NCw5ODYsMjE5Nyw5OTMsOTc3LDUzMCwyMjQzLDk4MSw5ODcsMjE4MiwyMjk1LDIxNTYsMjE1NywxMDkyLDgwNCwyMjM5LDIyMjEsOTk0LDk5OSw5OTgsOTk1LDEwMDcsMTAwOCwxMDEwLDEwMDUsMTEwMiwyMTk5LDIxOTgsMTAxMiwxMDIzLDEwOTgsMjIwMSwxMDIyLDEwNDAsMjQ3MSwyNDg4LDIxNTksMTA4OSwyMTc5LDExMjIsMTA4NywxMDQyLDEwNDMsMTA3NiwxMDc3LDIzNjIsMjQ5NywyMTcxLDI0ODksMjE3NywyMTc2LDI0OTEsMjUxMiwxMDgzLDUzMSw5OTIsOTkwLDIzNDcsMTA0MSwyMzk4LDIyMDIsMTAxOCwyNDQ0LDI0NzIsMTA5OSwxMDgyLDc4NCw1NTcsNzc4LDc4MiwxOSw2NTYsMjIyMCwyMjk0XX0=; lng=en; cookies_agree_type=3; tzo=1; is12h=0; referral_values=%7B%22type%22%3A%22reflinkid%22%2C%22val%22%3A%22d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder%22%2C%22additional%22%3A%7B%22name_tag%22%3A%22tag%22%7D%7D; reflinkid=d_34142m_23455c_MSnullnullgeneralsite_id_d22490_l35237_clickunder; auid=U5Pgn2kXGuJg9yU4AwNKAg==; window_width=1280; che_g=22b78b6c-0d92-4b18-a655-a4392ed48553; SESSION=13033e2b8d7c5d02143e1c584c11d481\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Fri, 14 Nov 2025 12:05:00 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\ncontent-length: 1537\r\ncache-control: public, max-age=300\r\ncontent-encoding: gzip\r\netag: 17cc4ade9ae4dd646178200428d67b62\r\nvary: Accept-Encoding\r\nx-dt: 1103\r\nx-request-guid: 705489251212580cc27c578cc5ad02ed\r\nx-time-ng: 0.000\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nserver-timing: dt_total;dur=0.127, wf-uht;dur=0.011\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3281,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (3280)","md5":"17cc4ade9ae4dd646178200428d67b62","sha1":"8949891455535a68218c809864ed91eb0f800c84","sha256":"b0c9aa9ea44642cc4d2a68a6a0ea81b2d8578aca18a4769c64f8b482189572c3","sha512":"ed1d64775d6f6aee5ac22448f6678a4742459eec3389d87d9383e7053ed5cf31cc74eb8ef0b3f3597b02e16f53d07bf88b2b7695c5f072cae01f7c2e48b00155","ssdeep":"","tlshash":"316182a764ae7e1212480cc7a47e9a4b7050e9063ca9f850d0bf6ccf2404da1c9a1f1b","first_seen":"2025-10-17T07:26:39.008746Z","last_seen":"2025-12-13T09:36:03.351895Z","times_seen":1800,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":39,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-14","alert":"Sinkholed","trigger":"1xlite-837593.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}