{"report_id":"62ef915e-bc25-406a-9e48-fa4734fe3283","version":6,"status":"done","tags":[],"date":"2026-01-18T21:01:14Z","url":{"schema":"http","addr":"cashbackonsol.cyou","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"104.21.90.147","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"cashbackonsol.cyou/","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"title":"Unlock Finance Success with AMLTestWallet \u0026 AMLCheck 2!","dom":{"size":361380,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (45704)","md5":"e11e246273d21cb2fb537f32f97cb427","sha1":"1e64b8501dd691b50ae386719046edfaaf2cea95","sha256":"dfe03e8454e870c49c218a6f5536490f3fad6294cc5dc4ce738ac3797cde7ce9","sha512":"572c0c9c915944fa66028791c1affa436d8468b4532b31a9c20dab37a77b027dd51a0907b27197b37f2ada170561de496d034fd1c901de6eb2d0db051bc04d31","ssdeep":"3072:i4lRIAPURzqMey7gQLG7dRHpcCmhjtyqqaB+05hhU:xlKAPURWMJg0G7dRHpcCmhjtjO","tlshash":"2774961aa5b1407a3c1361f9efde691d723aa087dd2edea47edc2121cfc12f09d92644","dom_hash":"domhash7278ae38b1116b5f2cd44e6abd8e7e2a","first_seen":"2026-01-18T21:01:20.216431Z","last_seen":"2026-01-18T21:01:20.216431Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"cashbackonsol.cyou","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"104.21.90.147","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-22T21:01:14Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"cashbackonsol.cyou","ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-12-22","domain_rank":0,"first_seen":"2026-01-18T21:01:16.52372Z","last_seen":"2026-01-18T21:01:16.52372Z","alert_count":122,"request_count":61,"received_data":3840726,"sent_data":44673,"comment":"","tags":null,"fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-01-11T22:17:18.570046Z","alert_count":0,"request_count":1,"received_data":10794,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-01-11T22:14:24.773767Z","alert_count":0,"request_count":8,"received_data":275684,"sent_data":4476,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cashbackonsol.cyou/js/telegram-web-app.js","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"093ae7beff6809b8409f9a4886f8dbce","sha1":"3a85e6ebab056b65dabf70f342a631f15d207936","sha256":"a4ff9cb9c45c17922fdcdc2fed707bdb9e6482bc115e2dcca92baa92e45d83fc","sha512":"a35f2c3fcf7533f1066bef1a1c33eba1b37c7f305e9e7841604d23f29f570fac1ca4ebdd4bf28557dea525de957893ed443627a39a3e7af3a4354d9f85a8259b","ssdeep":"1536:wInz3pl05+Dgba0D2zX9gJQQHcvqmJFDtcH/dosRecqS9t9jInqx2GESm1Dr66CM:Tnz3pl8+lgJQzv51HIa","tlshash":"cbb31b4c5cf3216281b7b1ae8b5f960072759893305def213c8d9ba49f5493c53eabe8","size":116218,"data":"","first_seen":"2026-01-18T21:01:20.240607Z","last_seen":"2026-01-18T21:01:20.240607Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4a6012268eb97d80c8879764c5a1cb13","sha1":"759e7c924aad204655086f6cc012dfc192bce261","sha256":"8ea9aafaf8e18c7899921e1a8d2bf38d31e7e10fc34047abd652307f583379ba","sha512":"6da713fd4d9d9754d3079cb646fb0f4661ec43b0abd401a1993928b78939a4d8371151f2893350a3b83482c9d4c7856d7b12ea15cf0def710d1c5e4b399ac39d","ssdeep":"384:CgJ2LSyZXb5Gb8NgGvsR3QVTbSee7Nt/QtdXIj3hOxffs2hUA0VqSx/JIGUZZtdF:ulgX+IAEInvlR05vwziS","tlshash":"42d286b682b41a2ff6716b7add342ced485d0dafb510c3e06ddf386ba558470c2912e8","size":29456,"data":"","first_seen":"2026-01-18T21:01:20.408871Z","last_seen":"2026-01-18T21:01:20.408871Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/_nuxt/assets/index.js","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"365b301b0ccafe14e34167b86e121256","sha1":"c23783519d38dc1e24e2ac5c59549f78e72c9e5c","sha256":"56ab8943e25f3ce612325f42a862a2d85426ecd6a20c398f2a9df637397cc44f","sha512":"6c6c3a679c59e0e6e796f4c5ec14dada6be4698c313e1b2b6084071572de825ee64f7e08b71e029ecd271e65c56b2aa04afc20dade810cddba53df9618bd01c6","ssdeep":"12288:D+I1pHMfuYlEmzoAzlsF6K43bTcNwgwcjJC:D+I1guYlzzoAzyF6K+7gwcJC","tlshash":"29e408c73182b6a692083eb93cf02f754efc985180fa0afd65bbdec04598a7197475b4","size":692798,"data":"","first_seen":"2025-12-08T23:25:30.874219Z","last_seen":"2026-02-05T13:27:40.574193Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"11bc38a3cb312887743d2f82c0b4785d","sha1":"41ac805ac88f902e46e9261ae4855d241021dd62","sha256":"3621c569e0832d6534ff8bd397bc2f998c2fc5cd328cd41530ccf58430053bab","sha512":"b457504f3856338f01c80456a720f650cbf567010e6f600ce8c795b6bb63d470e829bc6297e5cb71eb57c23b38ff7bdce53379b75c9faf382cf0aec5d80d8c25","ssdeep":"6144:Wxwyt8G/eOcO5AaW9TVuMWkRN8yJqal2NI3oAxh4zQf+m8yfHDKzHFjjatR7cQJA:WL/g5u+l2a3oA3IjjagQJR/GNGcw8j","tlshash":"71e4f8c43182ba67c6483fb97de163c54f6c9c61c0fd4ae879fce38049d8a52559b2b8","size":661873,"data":"","first_seen":"2025-12-08T23:25:30.872057Z","last_seen":"2026-02-05T13:27:40.606308Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/2d6a5d77ce9d27f3e017dab40b83d776cea1fd61.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.359Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/2d6a5d77ce9d27f3e017dab40b83d776cea1fd61.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7792\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"1e70-19a6de733a2\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a4Fe3ZI3Z7%2BKKdaWxdNZHhRpiwLwdKFLywbax3S7YHqEYxjqqV4fG4ovcvHi49ypZfZYmR6BD7ZQOHvAozldq0O0wh156XsWU2IeAxFkILc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b8c5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7792,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c9fce6a80944b3ef1e802af66eb21b3b","sha1":"66622813da05f2fc960379369f0586b205c8734c","sha256":"f2dcdc9cbc64532ad8d0e4977785a18111484c8445bf4876085f8720afe93fbe","sha512":"a684d17828dbb45b4824bf2a6d3e46dc10a6b74b8c4c3b000814a7be900be87170a0ccda272370ee838c5f97cdb047360b077fbff625a591ad3e3468ffedeabb","ssdeep":"192:ldBsX4Sj4UWMbSF3gZB9+MZa0mxm7VFQ+EGSS:Tap4UXORQZRh","tlshash":"a2f1bf5b6933c24d8cee7f25a185308fc7b53795c45713fd8448a196a8ff763e8a0129","first_seen":"2026-01-18T21:01:20.219784Z","last_seen":"2026-01-18T21:01:20.219784Z","times_seen":1,"resource_available":false,"data":null}},"time_used":263,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/api/config","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /api/config HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://cashbackonsol.cyou/\r\ncontent-language: en-US,q=0.8;en\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 188\r\npriority: u=4,i=?0\r\netag: W/\"bc-HPJdPZdfSLcXYORURpOPhHMndnE\"\r\nx-powered-by: Express\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ykwI33FuIeiPz%2Bt5q0N4vtldxfnhsHiaL5gA97%2FOzdutE8qGswlxvmTpzZOb4bdHpgQ8pvzlLdf3deeRBWfFjXyVqx7GRrYCuSCm3JqYW5w%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0106358c7f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":188,"size_decoded":0,"mime_type":"application/octet-stream","magic":"data","md5":"cdf8698e20420534a23207a0b644919a","sha1":"1cf25d3d975f48b71760e45446938f8473277671","sha256":"27a326b83e331f6f447a9fa2f18c9946a7f786694b4c2aabe635eb7bc0dee300","sha512":"9512f2a12bc6e630e9e0a1858eda4159b70d0028aa0c781f0dcf923303f863979a2641fc6aa59a2d4cab56d1996e988cac711f1bfaa45b2c513b376119e636f5","ssdeep":"","tlshash":"f9c0223530003a40aa60ecfd0563260894e47afe44288da1921b8c0291a11233082dc8","first_seen":"2026-01-18T21:01:20.223005Z","last_seen":"2026-01-18T21:01:20.223005Z","times_seen":1,"resource_available":false,"data":null}},"time_used":105,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":105,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/favicon.ico","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/favicon.ico HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 500 Internal Server Error\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:52 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=6,i=?0\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yTzr6bJUsW9LRGhFMrtmJAlREzrWX94S%2B1xbOPMswPpW5ihzawfLKkJ9dsnrQZLDjIwhIMyLXp62q4Se8u3SNKuUvaBMoRGnyHPgzmjTZLg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0106388cd05684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":237,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"0f344a6efa44bbccba85174fe232cf94","sha1":"c850f759fe50ba9ad4efbe811871ba002e26ed5a","sha256":"a64076e068dfe385392e6be8a1eb8bbabd40f9587b50c393119d5a256d68d2cb","sha512":"c4fef958534586dabe5e6bf1aff8d2c0e002968b3c5a6028f11dda9a6d7c1e14b48188449599273c561e7f2e95cff5f2cf6d7d0d539cda1d608da0cc7314add6","ssdeep":"","tlshash":"0ad09702307012020a70be084a85636e91477bc53deea1013acbe103e8f0a1ac8ce3a4","first_seen":"2026-01-18T21:01:20.226684Z","last_seen":"2026-01-18T21:01:20.226684Z","times_seen":1,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/jgilz.css","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.293Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/jgilz.css HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"17c5d-19a6de733cb\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZIy8lKrMCU1ejNYv%2Fs1ih2u49w5o0DptuwMWhA6NJCfewZQS5s8M5As%2FaGnKg6gumj3lh3vCCl%2Beuzt7ZBH8fMBGzPK%2BnjyhP6GK3nEmbR8%3D\"}]}\r\ncf-ray: 9c01062e3b705684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":97373,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"38a958abd7c3a7a2dbac0a9d4354f6f3","sha1":"356977a42abc1c15fa720942cc29d15f7bf91195","sha256":"dbdd2f8943547bec0a60068e3bdcf461adcc211023e6e3c9949c52adb818e95c","sha512":"25e55e0bf961c0b40c3370e7b1a55b5c01021e8d49dbe6e6ae7e507e7b683981758a38150a13bc7061372f1b5b087ee019067f900967cfc8ad5fed43de735482","ssdeep":"768:NuHFIy653Pd/iT2XFZFYem+bFwL1z3idJDk:oPYNi+HWaGzuI","tlshash":"0f93241617631845680b98181ffe1764726890439a0fdaf87ecb7644cf8f6a8b5b2fcd","first_seen":"2026-01-18T21:01:20.231407Z","last_seen":"2026-01-18T21:01:20.231407Z","times_seen":1,"resource_available":false,"data":null}},"time_used":450,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":194,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/6b940a1205537db46cf4299e059085e87d60a7b7.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/6b940a1205537db46cf4299e059085e87d60a7b7.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9360\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"2490-19a6de733ad\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yzQSsfT4gY3GhUw%2BIy6DschZCz88eLkG1XMAn4XIhGTJg64PepDv8ffCwqU0yR44h%2BtbGt8RBi3HhlFezXyDJGd6BSSbzTrCb5i1Y8GZE%2FE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e9b8f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":9360,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4b450df74ba70814f9b49753691360d4","sha1":"628554efabc2ceac12b909ed37adf4aa5007fddb","sha256":"a525e4c3bf55c7802cc0faa44da56ca9293caa632a2bc9cb450e348c995cea8a","sha512":"f74fd64b770ffc9d07f63cebe85a8285a3c132e13b7e2aedaadb234235fd8607760f7bb5d2cee485af1ae0cce3c5d6c1a777509fb9638ab95cc97c17a8720a7e","ssdeep":"192:9qb5Qrf2C4BCPT3fZynf8dnuT/6pJcsnnWwsjihKlS:9qlQrF40T3fQf8NuTuqqh6S","tlshash":"b512aeab04d976879ccc7af98f96538209eac0ec0ec3c5744da1b146541f72b5babc18","first_seen":"2026-01-18T21:01:20.235277Z","last_seen":"2026-01-18T21:01:20.235277Z","times_seen":1,"resource_available":false,"data":null}},"time_used":268,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":267,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/m0izv.css","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.286Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/m0izv.css HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"30e-19a6de733cb\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HdBN%2FzFEdpvUhqJGUMskcvXDx7R084sA%2F1nnfMf%2Fqci3BSRjLFlC79UZnYVNNv9wtTbetbb1y46mFnmXAgP%2FUMlmmRhMs8eaB7gEfebTKpk%3D\"}]}\r\ncf-ray: 9c01062e3b6d5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":782,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"7eed0cbd6a15d4ac79dee3bebd09772d","sha1":"0103d5556667314366572969935304f1f1ec12df","sha256":"7950d3ab1f340deff3ee17495cea701ff796a5817b571c724cc4e82922335a7a","sha512":"9391f245ada8111b586386c044895b89c1c941cfc6cd111c6468a0fd030c77b97754b73fa793965c84bb28020a4e1456d930d484d4f3d9cf6e8b885045798f21","ssdeep":"","tlshash":"8401bd5bda2709037a02d56e8f6a76533b770107cb0ecb0836b0b66bffc19b450d4644","first_seen":"2026-01-18T21:01:20.238324Z","last_seen":"2026-01-18T21:01:20.238324Z","times_seen":1,"resource_available":false,"data":null}},"time_used":269,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/js/telegram-web-app.js","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.298Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /js/telegram-web-app.js HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/javascript; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"1c5fa-19a6de73386\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LiHJUJq7Nr%2FycS78m59dPpMdX4K0YLdBq8vtZype8qC2ClxF8CI7eUsNPs4mVlzaPT6qhIwDP6Co1R0D%2B0sElsQUgQrmIDYmL5mPLACfnm8%3D\"}]}\r\ncf-ray: 9c01062e4b735684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":116218,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (824)","md5":"093ae7beff6809b8409f9a4886f8dbce","sha1":"3a85e6ebab056b65dabf70f342a631f15d207936","sha256":"a4ff9cb9c45c17922fdcdc2fed707bdb9e6482bc115e2dcca92baa92e45d83fc","sha512":"a35f2c3fcf7533f1066bef1a1c33eba1b37c7f305e9e7841604d23f29f570fac1ca4ebdd4bf28557dea525de957893ed443627a39a3e7af3a4354d9f85a8259b","ssdeep":"1536:wInz3pl05+Dgba0D2zX9gJQQHcvqmJFDtcH/dosRecqS9t9jInqx2GESm1Dr66CM:Tnz3pl8+lgJQzv51HIa","tlshash":"cbb31b4c5cf3216281b7b1ae8b5f960072759893305def213c8d9ba49f5493c53eabe8","first_seen":"2026-01-18T21:01:20.240607Z","last_seen":"2026-01-18T21:01:20.240607Z","times_seen":1,"resource_available":true,"data":null}},"time_used":506,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":265,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/how-does-DnlstxIX.svg","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.333Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/how-does-DnlstxIX.svg HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"1270d-19a6de733c8\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=CPF05%2B7ZJ5sGZRCRkQ2kbwNmLf3zbUJPOn2wxA9rW%2Fwjx118Ot7eTrVIFULl1ou2EOMM6yl0lpHZYQOCYogPqnYZ%2BWUwAokh4DTCawxUN0c%3D\"}]}\r\ncf-ray: 9c01062e7b7a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":75533,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f74cda42deb365718c80d66ae85c229a","sha1":"4239d279133a77b716a777486656143cf4338569","sha256":"f01c6f20d0beb7cb60a8831b8da262f042cd98a11a758be9032a2459550d4c98","sha512":"d6e3819cb59a1f4e9d1f9802d17c8015e978702b3eeaaeaa4fd61d5bf22a47aae20333fde7abcdb2d450383e9d1617f6edbfd3588d5d0b540376e0dd88a5f7e0","ssdeep":"768:oPk3zyS7R4f5w0BpHL9HMayHkEBGhFUfSmAVg3wTcECVSW7pfxMXuGgNQrdpW4gG:O04o7kF3DTcD7pZy/JkBZga4V","tlshash":"757383dc3f708cc55ec48bdb7f1150ec6a57d5b3aa898e08d15c8f6d088682c9dea983","first_seen":"2025-04-08T20:33:55.218198Z","last_seen":"2026-08-05T21:27:26.027073Z","times_seen":514,"resource_available":false,"data":null}},"time_used":412,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":242,"receive":170,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/team4-B3PbVeRF.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.346Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/team4-B3PbVeRF.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5596\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"15dc-19a6de733cd\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HM%2BaGrJBCrlMjuwQ80dY1DOJlc5Arqo2Lyjhmj9%2F6ZdQmlZdjD3UTva52Y%2BtOPPN%2BrYf%2FF%2BzcG%2B2OQbpqvwIop7p%2FA%2F0es%2FFW4dfV39nIOU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b835684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":5596,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 466x368, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"53630bdfcf2b3b40545ce59f39ec3ede","sha1":"667ac0e9c74df1aa9906b36569df776a426ba331","sha256":"96cf110e502efda30349a39db2e4a53603a7a15c54b15cba9e2725b1e1b39048","sha512":"72810d40e3118f97b525598244ea5c4db6d31c2d13e1f33375777df22a761df0efb87d576f2ea787b287b6a237378c74a4a27819927bd4d0b536edb2f2f1f363","ssdeep":"96:gHl2i9sBMFgv+7N784+I1LVJjKH/te37o3k44SEDCydF7aQbP4n1+fv2v:gHl24sq2v+e4JVJjKH67o3+DCUFmq4nf","tlshash":"88b19e13da1678d3eba4f91455a2cc120ae5f8c234c5fb0644b659632dd03d3affd42a","first_seen":"2026-01-18T21:01:20.258437Z","last_seen":"2026-01-18T21:01:20.258437Z","times_seen":1,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":247,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/18ca64bcf3b61fc77291e65174a6b321f5eb4f3b.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.354Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/18ca64bcf3b61fc77291e65174a6b321f5eb4f3b.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8110\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"1fae-19a6de7339f\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0y8tUvNTC1aDsMnIM0SlsVSYRIqnb%2BUmQi0%2FKQLE40AHtO14vE6vnQ2Ln27t0oQYYfBrcaZe7igiVked9D1ucf%2FDctVb8UON6r9%2BJ6KrU0Y%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b895684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":8110,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"44cc0048f252155bafd199aded6c9c2b","sha1":"42e026dd2d5f179734bead50a17edb508140697f","sha256":"90b40c02ced44d90f2d530251dde9d27887097f12f0bf555291349be5eb087bf","sha512":"22f2805513b891f0eb354bc9a627648edd59ed18b1928120b0e44fe3c57a050bff44cea3e39713cc3744b94b4c54164b90c3561dae18c59e0a6fa4b498ec2e27","ssdeep":"192:1IcqgOHkwadKaxkQagSE0454LLpwoUUUHcKmnF:1IcqgOHskaGQH04uLnJnF","tlshash":"16f1ae435040a438e41e34f17bc9d0d72e50e4b6e0d8df99b9fd6e20855a13aee2c791","first_seen":"2026-01-18T21:01:20.26402Z","last_seen":"2026-01-18T21:01:20.26402Z","times_seen":1,"resource_available":false,"data":null}},"time_used":289,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":289,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/menu1.png.html","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.810Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/menu1.png.html HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/jgilz.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 500 Internal Server Error\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9eksEUxDZs%2BJtfJZz3NRdHs9FpDgBUKRGzaT1jvfOLU%2BwFNHySPFbFczMYVI3ymsSwdppuFO3OhzoyfKE92%2BXo2jYJw4oNyDBDrsAVGUKXE%3D\"}]}\r\ncf-ray: 9c0106319bdf5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":225,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"0380655056bf12965a4e4b56df53cc07","sha1":"0b240163246f256b68c7f89913e4481c57cb4cf2","sha256":"be063d304735e5cb2f5f36ce804a75cb5379c8a398310ef69a02e99eb6ac1eb9","sha512":"c884763d8c2e2af08e0bffa0f62d34b296a8879a6e145e905fa3db5b7fb98c6aa17b6b835465e4d5cc3f1136033d45c75c76f906c9de373c79e0e9e41d472430","ssdeep":"","tlshash":"f2d0a702207012020960ae444689667e615777c6799a95002686e143aca571ac9da6a5","first_seen":"2026-01-18T21:01:20.266293Z","last_seen":"2026-01-18T21:01:20.266293Z","times_seen":1,"resource_available":false,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"216.58.211.10","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"A8:BA:6B:80:7C:EC:B1:6F:C1:C2:03:D7:C9:27:6E:75:DE:4B:AA:47","sha256":"4E:2C:B9:C5:81:56:5E:97:93:07:22:12:66:E2:52:C6:0A:2E:17:72:FF:9B:5F:2A:B9:E1:21:80:05:6D:8B:3D"}}},"request":{"raw":"GET /css2?family=Inter:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 18 Jan 2026 21:00:51 GMT\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10108,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"e85517dadd43448782d60d7f207fddce","sha1":"6cd31f870727ba8090fac9602b42524b4139a619","sha256":"88fbd0b95222be288587a149c324189ecbd8de0d6f0c94f528ec53857e52b66c","sha512":"5edc78df5bb062a9a2e1ea6724c14dd7eb80d77ea0fa9572de4bb0d52bbd0d163815b08a1ae77084f99fbefbb07715da1c61f0bb36fb498710c91387792955f8","ssdeep":"192:9NNIxO34OxDENOPCO3/Nx8NNryfO3iExlONEhYO3RrxGx:vXuM0p2+4","tlshash":"04227792002ba400ab971dc233cf7f3aaece50896085d1b95ffd0dc59cead66436876d","first_seen":"2025-09-10T18:13:11.065101Z","last_seen":"2026-08-13T20:53:02.484668Z","times_seen":40376,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":107,"dns":1,"connect":7,"send":0,"wait":19,"receive":0,"ssl":97},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/1-B8hMQnFc.svg","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.335Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/1-B8hMQnFc.svg HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/svg+xml\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"dadf3-19a6de7339c\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=b1zXNjjyhlQ8gDrUBjWnMlKMQuzKrjj7t7mViD5f8FovnvzEm%2Fq5iPN2cpdACCGKVqM5rOoH8lyqWbT%2BOmUn%2BFsKFPAs5Y6e8%2BHNtXPlQA4%3D\"}]}\r\ncf-ray: 9c01062e7b7b5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":896499,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7e54ee403da676c99d77633c01b606c3","sha1":"351c6bb9a4dba01eed5cc86ac6ae0a38f3e472f6","sha256":"59fee31a79439edb17dccae8553674f87012403c8a486c9b098a1e294c119e65","sha512":"7cc6dd0aea72a3f8e9c324dec727ab5133eef87d600768bf29801201118d4025fae2ce28071582dd3699b13a1ded3f3b78c56aa9fb53a67c7e5d1bcb7a099947","ssdeep":"24576:euayhlfPkhRx15QVsLcIuJ2wStoU6ghC5:eaDex6gW","tlshash":"be151214f80ae5b503bd0a251eb7156c6f748f709895ab8e87ac774683983c0f3ede25","first_seen":"2025-04-08T20:33:55.231096Z","last_seen":"2026-08-05T21:27:26.066863Z","times_seen":466,"resource_available":false,"data":null}},"time_used":691,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":451,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/team3-DH9H-rCm.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/team3-DH9H-rCm.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5918\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"171e-19a6de733cc\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Rj4kCeikG3lEVspEsfJUqfFPHc0zbE7iSZwKZ01DZT6DqBI1xgfP6XYyV6mnSNzCmGL0GTe0GSzoIqVIGWMCgHZ8s4a7S5hufN9NMIR%2BZbw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e7b7f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5918,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 468x365, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"265f718b4b785c7716c3ddda185b6a0c","sha1":"54438241c692d4d9d255e3b23f4d0aa0fc864457","sha256":"71fc0d28a1da9bb9b24e548a486af52c5c7a88c1c280e58c8cc8a146446ae9e3","sha512":"3880e5ed1782044ae3f881420fdf76d2b46b684a5c886e1f071c6879f634acfffb35b394c1f4aa231f2a43ad4143c0c88ec11619eb4c89138eee4b752a9d2b3d","ssdeep":"96:c9FhO1TVHhqWPN2omLwi1ZsJfvb1drkhlubusVoGoD2HOgEdZ+nDEMmX6E:6FhE5F2LwyZsdjrkhlub1nrOJdq8KE","tlshash":"bfc1af0ea86e53f83182452477fbb9d434185c8734c0fda08648edc276a647942f1779","first_seen":"2026-01-18T21:01:20.270995Z","last_seen":"2026-01-18T21:01:20.270995Z","times_seen":1,"resource_available":false,"data":null}},"time_used":290,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":290,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/team7-CmlWnAqS.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.349Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/team7-CmlWnAqS.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10236\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"27fc-19a6de733ce\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iqIDitQwN%2B4yNM3VEcShA0tSnrJAd2IPW3iqmchZyeWSEEl74a6sw4ZgqxQsMEw%2BtZisigaxdhBYPkfg2jqbHx4xZMgtzdANleKjT7V8y3g%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b865684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10236,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 466x365, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"219d89959d138af2337aea60a532023a","sha1":"523c45c3cd9e53b7df773f6a8cd992e16429d6f9","sha256":"17bd09fdaf728d6585dfb8d301417f038c082ff4120575d9cb42ae9b09685579","sha512":"b13c008ad5e4f115539187a51bf7ad08a0089846c03941bd2069790b42ec59bc016a6aca9cc7ca027a50dd99f850007388d776d55f260e3c0c87c52dd4d97687","ssdeep":"192:czOs92mdyoouCLkKS6OOAn3MvkgsP7DhdxnNexoA8qhAa6l:cbvwpx0csPZLnNI8ss","tlshash":"7922c0d26b3e286e57cab7212d57a62ac3a7444ac0087f244722600a3c15a02aeb7d54","first_seen":"2026-01-18T21:01:20.27354Z","last_seen":"2026-01-18T21:01:20.27354Z","times_seen":1,"resource_available":false,"data":null}},"time_used":261,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":259,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/cryptohome-Bkw0BUZH.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/cryptohome-Bkw0BUZH.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 12344\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"3038-19a6de733b1\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0rqwqjmoUfMg4cdMrJGYGu3awL5sQ%2BmdYoRwsYNR9xwzwblcNF8DAeTyZYjjUmUwa7dMlDpds9XgNnZ3dZp1RwgAqWdF8fZwxj361eA1Q64%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b8e5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":12344,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d4ccac6c21bc389d87b88a6b057410a9","sha1":"bfe420b23dc5080e605afba2a4f87a7ca1976449","sha256":"41b0cee3ab378a56934e2a2e9acac8e2b2fe9601fc746aaf187757bb8b2e7e83","sha512":"bf6e0e7a3581f813171985b1089261f65fdb56b893b37a2aa147a87d094348989b4297edf714e3d360f62211c572d8f3bd4ebecc5857e1c670fb39a24c04e22a","ssdeep":"384:zR81+f+/aIA//pqWgE7ySm2epfc7ETQx0K:u++Dw/pBgE7yffp40K","tlshash":"9542b013ecb54d4443f6277eca1a5c09c2b6e59a9d19f293a41290bc3872b60778b22f","first_seen":"2026-01-18T21:01:20.275987Z","last_seen":"2026-01-18T21:01:20.275987Z","times_seen":1,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":283,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.827Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/2e0uj.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48444\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"bd3c-19a6de733da\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zSMy5Eb2PwoJuAznvln7P5H6CYyot5dj28PHGYNc5wVomUcAQZfvmASPUBAAWSd2L%2FOK3A2r49xPYetuF1Ngyu3WyW798mWp8k%2FSf76Fct0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c010631abe55684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":48444,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48444, version 1.0","md5":"8e433c0592f77beb6dc527d7b90be120","sha1":"d7402416753ae1bb4cbd4b10d33a0c10517838bd","sha256":"f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af","sha512":"5e90f48b923bb95aeb49691d03dade8825c119b2fa28977ea170c41548900f4e0165e2869f97c7a9380d7ff8ff331a1da855500e5f7b0dfd2b9abd77a386bbf3","ssdeep":"768:dn0V9qZpy/4pR+9MzTCGXckDohHxCc/TfZQEh9UONYyPYcABoN/8rZujvB:dn0+rAmWUMooVrbZQE7NYyzABK8rQ1","tlshash":"0523f25daa398ea9ed25403bd63f2ff004c61409dd645cdfa62871bf2db290d06633d6","first_seen":"2024-07-30T23:13:06Z","last_seen":"2026-08-13T20:18:43.103507Z","times_seen":23695,"resource_available":false,"data":null}},"time_used":550,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":378,"receive":172,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/hhkhr.css","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.291Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/hhkhr.css HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"680c-19a6de733b3\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2KCnhmVPDhtMw9jdg5I8inscqJS70YnqDalAxxP6PmevYpBj9v2jza9lm9KPJ3O18KoGnBwKeIHOZYpcLnocQ32WtwxiFODZ4m%2BAmnl7euA%3D\"}]}\r\ncf-ray: 9c01062e3b6f5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":26636,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (26635)","md5":"c8e384ba2deeb4fce9a699abf848dba1","sha1":"fcc9fddc624802ee2d22a385a60c6affe904601e","sha256":"4aa3bf7740ffb24a1ad93204a81f8979c2cddc94edd0fe8a4c83066f10f08956","sha512":"1507328b345e3c7df465e38890f31d4b9ab5a07c016b547bc04a3e6e8332171466d99f3211f993407de8478260d190d562455fc46a6fff5839eaf1b1e0a20d15","ssdeep":"768:958qJOhWCeZmO6dOG6tuSG52qGZQdGade2KluiORWtCV444x+KGv0gQ1ueKPgQAh:4qJOhWCeZmO6dOG6tuSG52qGZGGade2W","tlshash":"65c2b25abe4cd104be435b0762df6a4855347588e530198afd2b31c62cd2ce7ba73fa8","first_seen":"2026-01-18T21:01:20.280162Z","last_seen":"2026-01-18T21:01:20.280162Z","times_seen":1,"resource_available":false,"data":null}},"time_used":290,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":83,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/fb4b89f0bfb71662c3833f8578a6c68d2e8bbcd8.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/fb4b89f0bfb71662c3833f8578a6c68d2e8bbcd8.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8280\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"2058-19a6de733b2\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EIbT8OoX%2BmjZ2p2RwWsacRl3fA12JZrKEclv4GApUgLI9ECe6y92FH5EPbYsTFxj%2BGwVbZL0fELVwTHgweosggM6H2uSHSTn2t9MbQmd8Qs%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e9b955684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":8280,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f67166dc1a1fb861a8b019155de68b51","sha1":"c3332d8bb5913f58c2472383d528b286261b4b6e","sha256":"90c1d89bd428afb8bbc8265d8055c9b0d50095ad0579c43513cda92bd9a15f78","sha512":"818cf78e3f17c5317fc2f770c4c50de43b1d1b5556e61e8c57d0f8403de86080f98a8d9c6eda95ed1b926d26333592df7c0940bc1f23996dc18a6c27229827dc","ssdeep":"192:ghTuiix/PVucJ1kSP0JfaCqGkMKedWKZIvVYcHC:Gsx/PxXk+0gGkdeOvRHC","tlshash":"9c02b03a70a304069ed023fe3ce06da6e24234d2fc5f695548f128a564c6d8b3c972f7","first_seen":"2026-01-18T21:01:20.28357Z","last_seen":"2026-01-18T21:01:20.28357Z","times_seen":1,"resource_available":false,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":292,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/44-DcUgPKtf.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/44-DcUgPKtf.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 44076\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"ac2c-19a6de733ac\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nox153gOR3a%2FNa8EtOerD%2BF2Aw2jX%2FbqSg%2Bvh0%2FF9qyMztmzpgF1tGjT8R1w6a1wnT4xGcufuXpLZk%2FJzGYxHUk4k4zjVkV%2F0CH1cPYshfY%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062eab9a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44076,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1de77cad657d941e5e51dbdb30609142","sha1":"22f1ddc813fdfffa1b12cdbc7d7aca9605e09269","sha256":"48cd82c23e297acc17b76519ecaedb7f30e4311931c74f3eef414b4afa37815b","sha512":"dd863c2b1ac396e6106a4df003f44e91337be8fe4e88c187f8e2d7c0d3ea7a9fa44985fee2b6554b972c7b7b6dec9d95e08694d0b398c572c4e4cbcab00df52e","ssdeep":"768:wX6IQ/Ztv0SUh7wkJsnW/dtl+t+lwM/IuGiSvruQ/jnpp37BWfaLehJUWeFlzCV:u/uvVceW/d8+GMDSvrBVDiJeF0","tlshash":"6e13f27b02760d6d7266a449d8f07eda93fb196ce16842c722d83b54f9c706c78232de","first_seen":"2026-01-18T21:01:20.28657Z","last_seen":"2026-01-18T21:01:20.28657Z","times_seen":1,"resource_available":false,"data":null}},"time_used":488,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":292,"receive":196,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/_nuxt/assets/index.js","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.297Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /_nuxt/assets/index.js HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\netag: W/\"a976e-7M4VDvrpySm5TnW9jLb3ACoRoyM\"\r\nx-powered-by: Express\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dGh2ultdKCvcj4Cv%2FOc3VUHkX9UtBGMrIvXDlsDboJhPuNBV9yBJy0Ya5MwFOsu86rzFtbv5upOKDSLxTz9EeNw%2FoaOWsnxFCLvUdIHyDVk%3D\"}]}\r\ncf-ray: 9c01062e3b725684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":694126,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text, with very long lines (56474), with no line terminators","md5":"6c7bfaa5a73432fac23a681a0e2afba9","sha1":"ea27bdba25311c711e12a10e0fd2561ebabf87c9","sha256":"bcc96ad87bd4ce05c69a86e3efdab9b92dbbe0550ca16df9f385bdf225192a6c","sha512":"c9e49a65326fcec18d2662b4c1e176d1e20c8689c539c88ce717af49927ce6ddb7c9f705e36820c8204fbd4835dbac3ee57fc9ebd96fbca521b4fae1cb6d14de","ssdeep":"12288:D+I1pHFAuYlEmzoAzlsF6DdhGNwgwcjJC:D+I17AuYlzzoAzyF6hgwcJC","tlshash":"37e4c6c73182e755a2083eb82df02f354eec999280fa0db977abdec146d4531874b5b6","first_seen":"2026-01-18T21:01:20.289198Z","last_seen":"2026-01-18T21:01:20.289198Z","times_seen":1,"resource_available":false,"data":null}},"time_used":743,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":269,"receive":474,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cashbackonsol.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:23:04 GMT\r\nexpires: Sun, 17 Jan 2027 18:23:04 GMT\r\ncache-control: public, max-age=31536000\r\nage: 95867\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-13T20:51:40.568999Z","times_seen":258246,"resource_available":false,"data":null}},"time_used":171,"timings":{"blocked":74,"dns":1,"connect":8,"send":0,"wait":9,"receive":10,"ssl":66},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.642Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cashbackonsol.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:23:04 GMT\r\nexpires: Sun, 17 Jan 2027 18:23:04 GMT\r\ncache-control: public, max-age=31536000\r\nage: 95867\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-13T20:51:40.568999Z","times_seen":258246,"resource_available":false,"data":null}},"time_used":169,"timings":{"blocked":74,"dns":0,"connect":27,"send":0,"wait":17,"receive":3,"ssl":43},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/2df0ecacf2e76a7e0ce20dcef096403f359de962.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.369Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/2df0ecacf2e76a7e0ce20dcef096403f359de962.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8394\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"20ca-19a6de733a3\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=F84dPjxwrr6X1cZ5RsDLFahND%2B9hhTRFHoP9I3Kq29N6Zv0oSe7nOXO29YiZW7i5epQ5L6RgJWm6%2BPEaAByWTpuPlGic6bKBIXseAJvj9tI%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e9b935684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8394,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"73419751e6f2581b105d3b9c8b427063","sha1":"bc790ae59fe063ef827584b1c29fdeec028234f0","sha256":"c0ae5349b4d7a2f751878d0559a4394392f1a827aa3c5b5bb502e4a893c0d6a6","sha512":"8a971a3e9f254569eadab11e467907d2a91c3e91592b8c87bb14b624fc4ae230034ea54dfa81420c4cdf13b57309939f9d8163177a189e1a85b104c9cf53078c","ssdeep":"192:JC0GDF9QxBo4f6gRzEdwRwR0DmSGlnpmMeh5wa+4M9c4EaF1Pa9HL:JC0GDTYBo01BwWGlnpZE7M9c4/1ir","tlshash":"2002af673cbb12fd0507be9f0639f4b36621968386c21705d11acf9a42792569d93378","first_seen":"2026-01-18T21:01:20.292728Z","last_seen":"2026-01-18T21:01:20.292728Z","times_seen":1,"resource_available":false,"data":null}},"time_used":290,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":289,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.489Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/2e0uj.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 18740\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"4934-19a6de733d8\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7gmB2K7kmf%2FgwGUd%2Fc%2Fgt9e6aKQFzyAza91Xm2abEYsEk0ktYkSjFZIhwp8TJ5B2VVfX98qzRkV5x1SxZCiPBr%2FptQ2alm7RgQiMMAYUVuk%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c010635dc8b5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":18740,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18740, version 1.0","md5":"06ab411342acdbfe3e746ee904e12cc5","sha1":"d83a47942575eeb80d30ebc7bf9a5b6f83c930fb","sha256":"62cc01daef72c3ea76a258445368d2f4ab8d05a91f91c53fd12f7c42e3325942","sha512":"6dc7ae210dc6578115ac9a4b78431be0f3f767684d3088ff5cd8094d1ce37756ce606571f325e6c97757dffe012d491792efac56efce2fb7a4fce9a7137cfc19","ssdeep":"384:AtbXebWepTmCSQiXLGg63eWz5WkPvRhc4Xci8yxpMNG:Adfeg9LGgHa3vRhj58yQNG","tlshash":"b082d05018f7583df26d8ab0279bb89e1b19bb7ff601d48e41319d4318f193846578af","first_seen":"2024-08-01T04:50:43Z","last_seen":"2026-08-13T14:22:34.864686Z","times_seen":962,"resource_available":false,"data":null}},"time_used":353,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":268,"receive":85,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.641Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cashbackonsol.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:23:04 GMT\r\nexpires: Sun, 17 Jan 2027 18:23:04 GMT\r\ncache-control: public, max-age=31536000\r\nage: 95867\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-13T20:51:40.568999Z","times_seen":258246,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":73,"dns":3,"connect":21,"send":0,"wait":14,"receive":4,"ssl":47},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/team8-Ba7qheCQ.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.351Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/team8-Ba7qheCQ.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 20730\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"50fa-19a6de733cf\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=83X3anGmwM50Gjp4MrZoIiRtOsU76e6bo4nkycxQCpGHVXCY5ZundsZBwaoh5WhKaCt4Aa2qhILy4XE12QIT9PUOdLUa8OHDENQJ8kg2Qnw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b875684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":20730,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 470x366, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"38c81f23997db101b6c9092d0247356c","sha1":"f737ec1b11d005d9f601d840a797d35a9ed72c76","sha256":"ec7e71bf6293a192ddc00763c8c5653d8f2af1ea3e0057fdd5c9af50d090cea7","sha512":"e721ff913f24a48f0739c4632a525a1c57dfe81a26e1841d96badb821ec114e1f7eb2466917ad1351beb9c81a029262c8f8c4bbdf3996e9d7ed681f177141a3b","ssdeep":"384:s6H4prntPs4Ph+b+Fm/dr6JpbtOd2N6WsP5ihj8LCf763A8cQdiYiO96Lvgw8paB:yJnpZZzA16JpbtOG6twhj806gyiY59C9","tlshash":"cd92d1f7dc34aab65c11515c45634a020333c29a7aeee3bc99a35de6718c1e15cb781f","first_seen":"2026-01-18T21:01:20.295166Z","last_seen":"2026-01-18T21:01:20.295166Z","times_seen":1,"resource_available":false,"data":null}},"time_used":363,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":270,"receive":93,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/team9-sIMRwxbc.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.353Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/team9-sIMRwxbc.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 12424\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"3088-19a6de733d0\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6Qa0YdLsABLoXDIPl5aFcnbL5E2JgXGKIQzUPalSxbuMzBumsKG9L5m034mAhIlw7M%2BslB5umzJTL%2FR4XRuRXkohxpvaleYfs2voeBo8jB0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b885684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":12424,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 468x366, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"169eaf06e349abc8218f77da8252d115","sha1":"60fc6072884942b2e84f9bf49360192ada26e767","sha256":"cd1914588729e4f4715c24be2938117489443d367728d9bfdae3c40e757cb83e","sha512":"6d1bf0ca8410e74dcc681381447ae7a6e9b36851d12721aed96952f2df7aea650a75de7149590af891e6655f031c0ea6ad890ea4d0b641064080b905bdebbf30","ssdeep":"384:V+oSs5hU6eFSFcKCoGoxSQm6AxuoprHqB:goSsvU6eF8cTdox9HRErKB","tlshash":"7242c06f44d0fc8b48139c6c469bb01c053ebb60e5259a25ddb57f27f4f2d805e5a603","first_seen":"2026-01-18T21:01:20.296685Z","last_seen":"2026-01-18T21:01:20.296685Z","times_seen":1,"resource_available":false,"data":null}},"time_used":289,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":287,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/668f0d3d472d295c224c9dba35f5e77a9926d1fb.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.368Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/668f0d3d472d295c224c9dba35f5e77a9926d1fb.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7294\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"1c7e-19a6de733ad\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cZVTucA02%2B4jE5Xi0SFx0Wx7hbNTHg8Et0DQxPAVy2%2FemIXvX8PZ2zMCOjpQx9hu6UMeUtrdF2JgNIhphd9NmCdvsygKc%2BMUF1irMIh058Q%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e9b925684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":7294,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c0eb3df1aa4a569c36b5decefde8d246","sha1":"9eac1053483aede1f1853ca6111ccbcba7f853c7","sha256":"6287a47e4d64e2b22f773b23843ed821d982891e1e42646f2fdbe88083f4dda1","sha512":"d87b2b3193433b45982254159864ff5935604dbf5819c4b49fd49b00c47220e647e89ef7bc90a72956f7a5e78b9d1766734ae01c48da69b250f17dd2d73a8a9b","ssdeep":"192:xFNPeE+QeD5RudbO5xvSNemvuCn1r6L4Kzd26uAfOAI9:xF0EgbQVuS1rWP2v9","tlshash":"08e18e9fdfd4b24ef6355082679f6daea0e60550c7726ad91e01e4026fa402f1bd1cd8","first_seen":"2026-01-18T21:01:20.299517Z","last_seen":"2026-01-18T21:01:20.299517Z","times_seen":1,"resource_available":false,"data":null}},"time_used":285,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":284,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/uniochange-B8zbqJSY.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.370Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/uniochange-B8zbqJSY.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9996\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"270c-19a6de733d1\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ShyNts95ngIfSlxLCt0Gt46lLHDVR%2BoZGlEIsqL0oj77hwG59gRCGJiZ%2Bmx6HfUpfwiHGG4iiW0piYLFlteEQxY0TX16NYLR9YuZWD0tceQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e9b945684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9996,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1e1137197c04c6336cd66a0db4151d83","sha1":"ea36edd05b505a5661d5caf2f600173eaafe8ce2","sha256":"0e3811778fdcbc6ba1e04695d62b4c3e0fc61d4f4c981ebd104ba2b1bac12508","sha512":"86e383dc3496f0f503d540e67769d7cc5e36c49bf01bf4b59441c681d9be0e04009b602be7c12f9aa43eefb74742237e7d24ff8ff0fc59bdf7b81da86f8220d5","ssdeep":"192:zl5Grve8EPnqTLjdWCpG2nLsj5MQJZ13THlE0LTY8lJyhWiB+i2cDu:TGrm8MqYCpGuLo5xT1bjLTY8zyvkilu","tlshash":"9722c044cea27d11382a2233b454dbea9e171674b0bce44a26970abf74b222c734577c","first_seen":"2026-01-18T21:01:20.303328Z","last_seen":"2026-01-18T21:01:20.303328Z","times_seen":1,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":282,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/api/is-banned","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.442Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /api/is-banned HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://cashbackonsol.cyou/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 1\r\npriority: u=4,i=?0\r\netag: W/\"1-tlifxqsNyCzxIJnRwtQKuZToQQw\"\r\nx-powered-by: Express\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tby3NeRwo4Qjct%2BPOp6EGkkMjHD8oLR5BMDMGdXWMyyzJCNWuPu%2BRWBDm4%2BOL%2Bf6W35TbJ5iCO34Njn5jzz2pGl0TcPxfkppuj8HnosIETw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c0106358c7e5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1,"size_decoded":0,"mime_type":"application/octet-stream","magic":"very short file (no magic)","md5":"cfcd208495d565ef66e7dff9f98764da","sha1":"b6589fc6ab0dc82cf12099d1c2d40ab994e8410c","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","sha512":"31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99","ssdeep":"","tlshash":"c700000000000000c00000300000000000000000000000000000000000000000000000","first_seen":"2023-03-07T01:37:31Z","last_seen":"2026-08-13T20:53:30.165968Z","times_seen":119380,"resource_available":true,"data":null}},"time_used":102,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":102,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-18T21:00:49.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncache-control: public, max-age=0\r\nvary: accept-encoding\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nset-cookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs; Path=/; HttpOnly; Secure; SameSite=None\r\nx-powered-by: Express\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=47Q0KSoXF0rt1tpesD4aXILS0gQFtT39jNB2Vf1bolfhyEgCHjTvWRPF1kBFqoqzBmY2XBfmegkS6Sd0t5Djl7Ak5YNT%2FwrJ6SI6%2FtC14Bg%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9c01062bd8f056b9-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vue.js","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Nuxt.js","description":"Nuxt is a Vue framework for developing modern web applications.","website":"https://nuxt.com","common_platform_enumeration":"","icon":"Nuxt.js.svg","categories":["JavaScript frameworks","Web frameworks","Web servers","Static site generator"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":344015,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (45765)","md5":"4e9ea10cb7f46a78a079fb1b6aef0462","sha1":"9d067f6fe990efc032361b23812124bc52570257","sha256":"43f7ecb1ebad8eb837449ed4162f85c0c154c7bdc463e678319914aa4c1f33bf","sha512":"a8d8314146237bae153b01ece78762818fc842f144c1704d4e620a250ebe594632afccecf39a8db7256ae0b0919b52b6252e6195e1babfbed2341c26658fcd31","ssdeep":"3072:j4lRIAPUVyzMlQQLG7dRHpcCmhjtyqqaB+05hhX:ElKAPUViIQ0G7dRHpcCmhjtjR","tlshash":"d374972a55b100762c2371f9efee661d727aa087de2ddea5bdcc2120cfc52f49d92244","first_seen":"2026-01-18T21:01:20.313206Z","last_seen":"2026-01-18T21:01:20.313206Z","times_seen":1,"resource_available":false,"data":null}},"time_used":338,"timings":{"blocked":63,"dns":42,"connect":1,"send":0,"wait":211,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/bq22q.css","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.295Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/bq22q.css HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"5d2b-19a6de733b1\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RInfDUCDNz8xGDdFgvAAa4k88DU3YkxgU4ffbg%2F4EPcSOkQpM4tMGSspVrr1vaQQFWfia4X7Cm6Z0u%2F8KSY6K6Y%2BriERk1vsWf%2FDII1lF1E%3D\"}]}\r\ncf-ray: 9c01062e3b715684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":23851,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (23850)","md5":"d849077e8b4cc93dd5c925165f2cded4","sha1":"496b8e753292cc78d4964d94eee5c250d53ca13a","sha256":"ee3512f8c59eaa415d996f68ce467b98f6a0cfe42631bb0196df90dccb04f855","sha512":"c97d51f2e5a2d75c4f7d8ec70e0eeb90b2fff45d63abc1f28b3f2a1780d5da779d5f821597baee476fa1dd315c78721c4f93aaee8a0a8b4f5465b237f41ef297","ssdeep":"192:CBh5Cif2Ib/m3ozgBVdX+LZDcFPAtmFHiJw3epAd/34JpG:CB72IrjgIFAFPAtmQa3Mu/ofG","tlshash":"43b2f9a1aa88e017f67a862f59c0f60875d9e50bfdf3085ef414d1008fd7e5f2a792a4","first_seen":"2023-07-01T11:25:55Z","last_seen":"2026-08-12T13:03:52.460154Z","times_seen":1947,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/85fbbbed31ccf33309e03046b9d7f8718c223a18.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.340Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/85fbbbed31ccf33309e03046b9d7f8718c223a18.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3766\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"eb6-19a6de733ad\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2DssVJ%2FEzv66GL3W9fc5arBsBW9M2WbopjSoetvqlshhsh9lArnAfJCLIB0x01K%2BwZZ4vZqVBpW9uuPU13KQvu5mCjnprIsY8vVXO5qWWlE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e7b7d5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3766,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 469x363, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9634674740c461b6ed67c3a27fc4f0c1","sha1":"73c3b4286340e28d2aa0375341d839a2be188ce5","sha256":"a5fd82defd765364e7c7970a11c599820422e3a57f2a76da600f793d8fef956c","sha512":"5c3de612799f8539d5eac8620b104082272c760bd9aa30168cd8b1dc5fafde2d9b667f93a06395c9503b5557370a77788c37690eb4ba06ec08891b987e1588ab","ssdeep":"","tlshash":"51718dc4e00177412800810ddc744f76e325e6b1a62daa315f0e4e781859eec23ede7b","first_seen":"2026-01-18T21:01:20.329515Z","last_seen":"2026-01-18T21:01:20.329515Z","times_seen":1,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":262,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/cost.png.html","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.815Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/cost.png.html HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/jgilz.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 500 Internal Server Error\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=597Ew%2Fp9GXIQB4sJ8AHKNEpLyfvwk9cnT%2Fm7ZkEddMS18IUjjQvbVKFATvApdo7u4Xe4tWwm5y%2FBsjC0kB2PfLBXr%2FNbAlQMmy03OEAM%2Bno%3D\"}]}\r\ncf-ray: 9c0106319be15684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":224,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"6717b2c8028b15e7e75839aed302d9d4","sha1":"27cc3443f4c31e877482b72488b495f5be254842","sha256":"ffcea381b78056363e3a3de9a856cce02369a0003d30ab495a9c65417d4b3ce7","sha512":"9f8e6b4c6c7511e0673d15aecb36aae577763017a1e774f583c76bcaae4d7d2d1a46456f34ebcafdd741da1917c2ddd0fee4f7599a4e6297490918676fd01c7a","ssdeep":"","tlshash":"36d0a702217012020960ae4446856a7e614777c6799a96002686e153a8a471ac9db2a5","first_seen":"2026-01-18T21:01:20.33491Z","last_seen":"2026-01-18T21:01:20.33491Z","times_seen":1,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/api/visit","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"POST /api/visit HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://cashbackonsol.cyou/\r\nOrigin: https://cashbackonsol.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 204 No Content\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:52 GMT\r\npriority: u=4,i=?0\r\netag: W/\"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk\"\r\nx-powered-by: Express\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=htgF%2FouCUgCyjekHpkHjkQOSF0Z9pl8SXDC%2FFmjt63K5nG17RKaBQD%2Fe51bDfiPD85e0psjWlifZ9upCj054%2BwQir0aUr5NpkK7lgz0Y4r4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c010638dcd45684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T20:51:55.920032Z","times_seen":17875984,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/2e0uj.css","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/2e0uj.css HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"6068-19a6de733a3\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2Fry%2Fnj0y%2FhTjI%2Fl44dstaY%2FID0OzMM%2B%2F2H5U60m%2BwsEy67tBhnDxE2mkb96afVp5OIR5IZp9u5wWNg%2B124Ucq8YYZs1LIQY%2BBt%2FlC%2FLzLY%3D\"}]}\r\ncf-ray: 9c01062e4b745684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24680,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"99995bd092685c674ed61e91d2ba5b9c","sha1":"cb292f6d7061578b33364932f428f2d5123eb377","sha256":"25fbe75ae95ec68f06b5f475647b3f660124e3c0686a0dbf4a7238f631419446","sha512":"399b1bf1823d1c9a09cb932dfb56a7ff42710a124c8b37b9eb1fcdbaf36256cd60627abf8ae7b0d1b211d958ce42ecb7922a0f00bed3841bc20a70d9b8d654b6","ssdeep":"192:9ZNEVc34SPDFZOr2c3/BP8jZENsc3RvPGheo0TaBmg+ev0MJBFg0eB0W3Bjg7GoM:rlxm00tt8cnamk9u3Eix6G1n+stp","tlshash":"bbb2ca90442b6100eb871cc627ce3f36ae8d25557086da386ffd1878acebd6553a4b1d","first_seen":"2026-01-18T21:01:20.338603Z","last_seen":"2026-01-18T21:01:20.338603Z","times_seen":1,"resource_available":false,"data":null}},"time_used":321,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":85,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/home-image-gzJaQJ7U.png","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.331Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/home-image-gzJaQJ7U.png HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 402322\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"62392-19a6de733c5\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lt6MQdIvYcmlJfRJcFSZ7HEbmeETfniwJtXjy0LQc0EiVsAP8EicndNSqkBdDlhfCd6nnn6uIo9NTdEef%2FdzvS0s3efDlyq8YDUClGjGCIA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e7b795684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":402322,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"99aed16a24857420704b08e704ffd7c3","sha1":"b8c608f1f90ec43b5d3ac73a522d1adf07d64bfe","sha256":"407a3e75c85b8f6cecc947372f46e0b460d4a8dea82c7b19691f1e4b3846e9ac","sha512":"2ef5716adce7ad295de2df043f5752ce110ae2a49fd5c271761e434deee9a983b9341be8c9aa93e23c2a045ab4895ff09ae6cc7dd659b96f28ab23e09afbf1c9","ssdeep":"6144:xggHHA4iU1xhu1YWqh51h70c+zqha3TFJ3iLQqOSNzK1NYUiKZ:3HgWJu1YNHuv3iLnOSNzinNZ","tlshash":"ce8423764b5d3856fd3e58f8a7340f87cf904657a9b9632260a51bbf08ec413e9820db","first_seen":"2026-01-18T21:01:20.340781Z","last_seen":"2026-01-18T21:01:20.340781Z","times_seen":1,"resource_available":false,"data":null}},"time_used":600,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":362,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/22-CzpWkn_R.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/22-CzpWkn_R.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 93262\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"16c4e-19a6de733a2\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=H2%2F9yIC2htEZzqXnusrSQSr%2BJ4GYkK27MQI8b7PtHJJcewmgG%2FHnhP%2FN%2F3oAHUL803K4HSxHahpRrOawAtnKRGXXktAaVOrNXYt6OWa%2Bl2U%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062eab985684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":93262,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e0be7dded7166f2c2a0086cd106b8184","sha1":"5c1d0a8725a257c41aaa41dfe09ed9d87218adfd","sha256":"1a709ae549160022f676078ff9e76f94f64385ec4ea882e2d790454dd92fc0f3","sha512":"93ded61ee25e43e82f1b9e9684767c57398edc75f5e5e4bf3ffe113ea415a7bd726c63a5384473829d73495eaf96c348eac336df308ae0c52524e22b53311bed","ssdeep":"1536:DLiDD+1ZqeQGvbs4gu+NzWsT8kRZL4PELKHnMUjJ+8BfMFOFM3cjqFH:DOH1eRIRPsPOKHMv8B0FOFZO","tlshash":"bd931264f06fe53a22c0d65cd95a3f2554a17f8e339f023bcd4740e3697f0e9aa94146","first_seen":"2026-01-18T21:01:20.343328Z","last_seen":"2026-01-18T21:01:20.343328Z","times_seen":1,"resource_available":false,"data":null}},"time_used":479,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":289,"receive":190,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/faq.png","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/faq.png HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 1042\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"412-19a6de733b2\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pQPvrUSiROamy%2BjrcRFfOHvDa02ks%2FR8scuvZtwSnBHvnbkN0PG%2FI0kQeigdnQ0N6jvFj1sz3l66fwseQAbFy1flNSIDAFJfGKGi3uBqg2o%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062eab9b5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":1042,"size_decoded":0,"mime_type":"image/png","magic":"RIFF (little-endian) data, Web/P image","md5":"31bb7ba54afd153bd9960bf38f687061","sha1":"47e754d23ddc472ce0beddc61be97e8d81cef53c","sha256":"a28f51eb91c450237b1ec2e30565c014495c8d90d51b95cb02732c3aba596fd4","sha512":"c448448f9a342e475a17a2575357c0f6183fddb53c950eedad1b8839c34c01f497b90371ea906a9193b82b3d8456d9b687734ceb36ea43b228d5695c0366b286","ssdeep":"","tlshash":"8d11d88050c93650189caf374b49928338bd1db18f7c0df0127675366d7435476b5de0","first_seen":"2026-01-18T21:01:20.355649Z","last_seen":"2026-01-18T21:01:20.355649Z","times_seen":1,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":277,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/menu2.png.html","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.808Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/menu2.png.html HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/jgilz.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 500 Internal Server Error\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kkGpwfUZvGpR%2B1aUC5Dn1vNKepsgWM2JJ9oPhddvWVPaD7Y2Qa1N7Tsnju%2FXTcoiwFiDytHGx%2B392ZT34HWiiKst2Lm%2Bsv%2FzGjsFb8BlqAQ%3D\"}]}\r\ncf-ray: 9c0106319bdd5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":225,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"97c0e9edadbbec9b99fb7b3730674158","sha1":"decbb0270676bed047960ef47a36fb2a3580f7cd","sha256":"40f4ef3ecb3f9beac1a6cccfd1eb7b14bbb33a73236e2132d63c54f42c456417","sha512":"56e2493477781bbed6bbbc151970ec54fe2177f1a3fdeaf5e6d2aff30ed1e4e90a8c1f2b5ab362d768003dcc8304e21072cd314148b5d2633f07304d34113335","ssdeep":"","tlshash":"8bd0a702207012024960ae444689667e615777c6799a95002686e143a8a571acada6a5","first_seen":"2026-01-18T21:01:20.362007Z","last_seen":"2026-01-18T21:01:20.362007Z","times_seen":1,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/shield.svg.html","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.819Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/shield.svg.html HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/jgilz.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 500 Internal Server Error\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ULNvLMWhYQyyLIav67ivmLau6OmfE6yPwoC9aAq9UGWwHDu2tat53Awqm8cfCY30haN5%2F6p5J1YSYL%2B3x4zDtiUUrUvHKYbeMUzoa0WYJDI%3D\"}]}\r\ncf-ray: 9c010631abe25684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":226,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"6c549693b893fed21da9ec6158731a3f","sha1":"9c56b68ae92bc12a1d4da7805c3b278a298e70f1","sha256":"0f92a08c45cdf6bf39c8af4f67405685ac3e423a2bf771358ccf5e531bc2119e","sha512":"9533264d617667bfab3fb662daf02b79dd00a1df97fcedfac821f6033afbf0e0a467edfe19d98a859293f8bc8302063f3164922707812afbb0cb8a7dd32ff0b8","ssdeep":"","tlshash":"62d0a702206122060960ae589685767e628777c6399a95006696e147bca461ac9da2a9","first_seen":"2026-01-18T21:01:20.363535Z","last_seen":"2026-01-18T21:01:20.363535Z","times_seen":1,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.825Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/2e0uj.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48444\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"bd3c-19a6de733da\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=G%2BAIbsSVVsDL%2Bj4EDq4eRPU%2FHaxfwU1mgvItOnQKg5D9MaZoiVaCrIgvDjDewn2D39IrUYumtoT7eovy0NfJChGMm1nZsCijftVsMflva%2F8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c010631abe35684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":48444,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48444, version 1.0","md5":"8e433c0592f77beb6dc527d7b90be120","sha1":"d7402416753ae1bb4cbd4b10d33a0c10517838bd","sha256":"f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af","sha512":"5e90f48b923bb95aeb49691d03dade8825c119b2fa28977ea170c41548900f4e0165e2869f97c7a9380d7ff8ff331a1da855500e5f7b0dfd2b9abd77a386bbf3","ssdeep":"768:dn0V9qZpy/4pR+9MzTCGXckDohHxCc/TfZQEh9UONYyPYcABoN/8rZujvB:dn0+rAmWUMooVrbZQE7NYyzABK8rQ1","tlshash":"0523f25daa398ea9ed25403bd63f2ff004c61409dd645cdfa62871bf2db290d06633d6","first_seen":"2024-07-30T23:13:06Z","last_seen":"2026-08-13T20:18:43.103507Z","times_seen":23695,"resource_available":false,"data":null}},"time_used":372,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":172,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/2e0uj.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 18740\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"4934-19a6de733d8\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2NNRqYDzMbsN5wduxTX3QOxHqS6AAcWBhwqtRYEVm1BP7ijERbtXJi4%2FSjTqOtWoxfzEa84gEPVDMZmESATC1ulH%2Fze2lkA4d8dLWj9XdfQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c010635bc875684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":18740,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18740, version 1.0","md5":"06ab411342acdbfe3e746ee904e12cc5","sha1":"d83a47942575eeb80d30ebc7bf9a5b6f83c930fb","sha256":"62cc01daef72c3ea76a258445368d2f4ab8d05a91f91c53fd12f7c42e3325942","sha512":"6dc7ae210dc6578115ac9a4b78431be0f3f767684d3088ff5cd8094d1ce37756ce606571f325e6c97757dffe012d491792efac56efce2fb7a4fce9a7137cfc19","ssdeep":"384:AtbXebWepTmCSQiXLGg63eWz5WkPvRhc4Xci8yxpMNG:Adfeg9LGgHa3vRhj58yQNG","tlshash":"b082d05018f7583df26d8ab0279bb89e1b19bb7ff601d48e41319d4318f193846578af","first_seen":"2024-08-01T04:50:43Z","last_seen":"2026-08-13T14:22:34.864686Z","times_seen":962,"resource_available":false,"data":null}},"time_used":187,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":100,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/bwc9u.css","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.303Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/bwc9u.css HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"63c3-19a6de733b1\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=lSWrxocMxzd%2BswT3VAWRG%2Bcx4SK6%2FPj7reI1Mu4W2JkRRc8gQOFhJuPJUncUlJTOZVSSzN97NjKA05Z7u987wxs%2FenbDs%2FYjAFkrHjTAdzk%3D\"}]}\r\ncf-ray: 9c01062e4b765684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25539,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"07869a568cd868cb515f1334026db2b0","sha1":"d9c595a395845e801ff2c6c0b8536193b6279aba","sha256":"728027792341d2770ca2a6c79dd5ac61bb8485381e822ab1692b10bb4b034db0","sha512":"04931629d8abfd461325683d041f3e42a7246fc3d3bcd55bd23297639f0c7762828cf7f040f13e46a92df918fc5aec87fa513736c53ded3e9cc216102f1a32a1","ssdeep":"384:aYGDdlPQs80vYUlEewG6V2mIKX9vbvGRvFvV:aYGDdlPQL0vYUlEewGKJIK9bvGRvFvV","tlshash":"63b245072a292802d60b94543de06f469a1ed053eb0eddf73c62a5acc6cd18d1db3bde","first_seen":"2026-01-18T21:01:20.365003Z","last_seen":"2026-01-18T21:01:20.365003Z","times_seen":1,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":215,"receive":85,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/npm/sweetalert2@11.7.16/dist/sweetalert2.all.min.js","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.306Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /npm/sweetalert2@11.7.16/dist/sweetalert2.all.min.js HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 500 Internal Server Error\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=3,i=?0\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HJLUf5wnO%2BG7Wy3FEf2ttrweBdA8E1pXoqpkSIzmPlGE3E9wIe%2FrvjONMMmqD990HMBVawy5fMqSfIf8H73YgM%2B4arpirp3%2B85X06o5TEWQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c01062e4b775684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T20:51:55.920032Z","times_seen":17875984,"resource_available":true,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/e1c98a7a1e1a7d4b504922bb5d6d9288b2aac2fb.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/e1c98a7a1e1a7d4b504922bb5d6d9288b2aac2fb.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8070\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"1f86-19a6de733b2\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=RWWtUAmGFJw2BGxsAqqtn4T%2FzyWAvyzDkuFd7gyHtckm1zlp%2FSv6iXPgtkQgbY4wz9JprXadp7LZOwVcK5Nv70aUO%2BTrJkwKjvvKF3xKvrU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e9b905684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":8070,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7f36a2cdf64aadf3110d5f1249075eb0","sha1":"b749449eb61c4d28f05f39cbe979776ecf0695dd","sha256":"c2b6f9bf815913bef427bf15237c3d4aaa591b19370901f27769ccf0a8047ee9","sha512":"34e3781d6803b8376b5e11e8cb700c9d81f22d5f0ffa95a634601915b2d9859ce521d58e607924441b20bf85f1bd8c21e1507d0dda923078f709f0f3dc35eb25","ssdeep":"192:ITj24XNuJGMpFtP2MuB4LijeQoB7XGGLmmjZJzIr:In24QGMpT2MuB4uyB7uspIr","tlshash":"e2f1a0c630634f3417bca581b8aff18d7163d9e8346ba74586c8907421019506bd6ff5","first_seen":"2026-01-18T21:01:20.366785Z","last_seen":"2026-01-18T21:01:20.366785Z","times_seen":1,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/11-CEJH9EXk.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.373Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/11-CEJH9EXk.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 57066\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"deea-19a6de7339f\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zcbJFsm4TMnvN9W6dPRscFm1mu3%2BiIgMfWhpFXsNryevPFB2eJW7LoHMkEPsQ30AnKKwsary3dafIzh%2BvOXisn3QYBZsvq0X4AXY0dHU6Yo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062eab975684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":57066,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"427aab9010fd6a751002673561668521","sha1":"960755283eb435d2419cf550d43b7e7b70d669b7","sha256":"2aa8877da27ba4e1876985cb51ac4cc5d32bca726fa1d16ef8b62a4b8e1249dc","sha512":"0a32126472602a20d9392f7e76211296969f236d6492ef1853fc7bb93112f01b72c6368a45290002afddd9f4a72842cd151d31ca059e09e26a7f3758329fc3c1","ssdeep":"1536:mFY9zthYya2e3qha6Tku7tGA0UPcFUHOilpuBgx71:ma9zda1J6TkupGA0ucFUHPdx71","tlshash":"874302c800fc60d71f331f5395afecf2644a782e980914f6699542a94cadeff81625b6","first_seen":"2026-01-18T21:01:20.368876Z","last_seen":"2026-01-18T21:01:20.368876Z","times_seen":1,"resource_available":false,"data":null}},"time_used":443,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":271,"receive":172,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/fonts/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.826Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/fonts/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/ahzbc.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 500 Internal Server Error\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cEBgIW3BhTi2b9qU06k5pOjQiC%2F%2FMxnTt2sU0INwI8mkzHXLxTwOYvxfyee%2FctPsCHxP69KnOktfg5pHQ5AxthjNIwV9FieljxIPcZ4hhWQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c010631abe45684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":259,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"2c8b2795361db33afd280931e17a9292","sha1":"865cc95cf6dc0758282b0e3d6cca04fce6b601bd","sha256":"b0d6d943a6fcad67ed9741e02e58c0560745c1f5865928f975ec858da1ee0173","sha512":"463c47796cc0467480c38154b46fca88a3fae81e7e3f03bbf0fc42cdc3c61900c3f3ae25dde11ffdfa352fbfe303affa14b73a3b7356acce7ea998e4698411d2","ssdeep":"","tlshash":"eed02b032021524205606e155781676e228377c9399e910026ca914358f0609c9da3a5","first_seen":"2026-01-18T21:01:20.371469Z","last_seen":"2026-01-18T21:01:20.371469Z","times_seen":1,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.647Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cashbackonsol.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 11:04:02 GMT\r\nexpires: Sun, 17 Jan 2027 11:04:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 122209\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18720,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-08-13T19:24:09.455974Z","times_seen":11512,"resource_available":false,"data":null}},"time_used":76,"timings":{"blocked":58,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/ahzbc.css","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.288Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/ahzbc.css HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-encoding: br\r\ncache-control: public, max-age=14400\r\netag: W/\"8e2-19a6de733ad\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WBwC9eymjTQAD3zairp09ipu%2FxP7oAkIHYiSskjCOQ1qYtmLg7xfd9unK45qvL22K%2FZQZkNAaubylJH89WiQrit8usgtbBYvYVXjCIj5cBk%3D\"}]}\r\ncf-ray: 9c01062e3b6e5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":2274,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"8c80efbb72f249e4bb85be2e3a805e64","sha1":"5280a7f93a13e8d6d3f1915b58de7b718de3314e","sha256":"31c02e6b7db0b7841642c8449039104332b79889834cdd7b902a98927ad1a574","sha512":"7b16b70368b0403a3feedaa594315cdceb4297d88587737fb716e35a827fd70c8eebc59e1713b556dcb419af54c36c8e72542be5b4e835ebdd8bd26b77361886","ssdeep":"","tlshash":"4e418880482b6104a6871cd227ce3f262e8ca4487045d6b93ffd18ab9cead6513a074e","first_seen":"2026-01-18T21:01:20.382998Z","last_seen":"2026-01-18T21:01:20.382998Z","times_seen":1,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/team5-Z1xAavYy.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.347Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/team5-Z1xAavYy.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5942\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"1736-19a6de733cd\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gvJ%2BoSAKfs14ngES9epveTRHzNHeb1Zd4x%2FwWmjLTCtqD8VFSOsUX1Zn8gNxCPo7xS5OI31WqfqfAbgF7vPq5t1%2FDbhTsWM2iGxVW2iamBc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b845684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5942,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 468x363, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"10a21f3a56629293db720d440bb5ef0a","sha1":"b1beaa36643ca0626075259cdc075e36c357245c","sha256":"65c711b35b52bfb19751623bfb9ad8c01504ff04293be82e5288b09579588fbb","sha512":"782e1bcc45553e168d39345f6194b348564996f2654de258c62b2cc7470501f84f5e2ba37efc12e01dd53db9fadc591354b56d39ee4c5f0b8c8baef2e8c54a7a","ssdeep":"96:dpU+H4wpeS5ZilRocn4Yd64weXJTvLbLResHb320a4KAGHWyFiXMyvsYOqQrLlZH:cyRphz567J7NRrhGEZkYOLk0","tlshash":"49c1ae218e40ed219c96352150881d68916ce8368d8b7b320fd78dcdbae7d6e9b1a026","first_seen":"2026-01-18T21:01:20.385622Z","last_seen":"2026-01-18T21:01:20.385622Z","times_seen":1,"resource_available":false,"data":null}},"time_used":286,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":285,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/2e0uj.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 48444\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"bd3c-19a6de733da\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\nage: 0\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vRLr%2BkLYg3wtSri1USKkn3WIvi9fkty%2BFNmJZvWt7%2Fq%2FiQbtiqyWpvOSxW%2Be1kY6w0A3OgCUy5liGJpqq8aI6CvfNtnUIoDVVbL4TplJOqE%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c010631bbe65684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":48444,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48444, version 1.0","md5":"8e433c0592f77beb6dc527d7b90be120","sha1":"d7402416753ae1bb4cbd4b10d33a0c10517838bd","sha256":"f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af","sha512":"5e90f48b923bb95aeb49691d03dade8825c119b2fa28977ea170c41548900f4e0165e2869f97c7a9380d7ff8ff331a1da855500e5f7b0dfd2b9abd77a386bbf3","ssdeep":"768:dn0V9qZpy/4pR+9MzTCGXckDohHxCc/TfZQEh9UONYyPYcABoN/8rZujvB:dn0+rAmWUMooVrbZQE7NYyzABK8rQ1","tlshash":"0523f25daa398ea9ed25403bd63f2ff004c61409dd645cdfa62871bf2db290d06633d6","first_seen":"2024-07-30T23:13:06Z","last_seen":"2026-08-13T20:18:43.103507Z","times_seen":23695,"resource_available":false,"data":null}},"time_used":540,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":369,"receive":171,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/fonts/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/fonts/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/ahzbc.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 500 Internal Server Error\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=4,i=?0\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X0Uj56brYs3T3RNGmdW7h7t%2BeL8%2FNqUFbtOISbN2pIvEaLNWDq%2B2knLpNRGtFzyDNV2rByHzD74Ak8D7eRhBzGbO7Wh9hhhefRdiXdOV40s%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c010635cc895684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":262,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"fad78e8700084613bff04db572337c33","sha1":"e603400f175cb919046669f8434654247eb25aa9","sha256":"3f5dbb079f970b0fbafaae980751a24c18059cfaee365c5e693c59dcfea25608","sha512":"8fb6f75791f4f0c9222847339e5990bf32a4bd8ae23c03e53cc710f47ae730a9a42e236044126c3b8a7f1abdfb475be92f8264390af1a679d6abe5aef50273a8","ssdeep":"","tlshash":"acd02b42203123420560ae15568167ae228377c93a9ad24426c6b1435cf061dc9da3a5","first_seen":"2026-01-18T21:01:20.387902Z","last_seen":"2026-01-18T21:01:20.387902Z","times_seen":1,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/oneobmen-CyrSxzF4.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.357Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/oneobmen-CyrSxzF4.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10038\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"2736-19a6de733cc\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LW6hDS5kgCpE1b86CCbBQBVrDKJgxnTiZOKQIVtGZomgPaWInDyPIT6S6BkdFwQhAYWWRbzt%2FNjsFSFMp1exOcIdgBZalnCKH%2BukPRpbbno%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b8a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":10038,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f5a1849cae9ceebbe2e31a814ace2836","sha1":"22bb1a7f0f432ac0cf2034c2daf67f6c2690ab42","sha256":"93089feff57a254c4f5ffdf8b1d3fe764c76cdc34e33aba7044efdb2b28135c8","sha512":"9e6cca6dcdd632aa71b2b33ed043a64fca38470f7b95bb0002c4f04bf512cbcb0d75a3d4a81964be3ec8fa827520164d508a0731e1d905a1a8fe4f3e71352eb1","ssdeep":"192:DukhFOrZOB7Y5BVkt9A+I1grgGFmioICXeE23J1tj33aoroh:DukJubu3ogsGFhoNXed5f3Troh","tlshash":"c322c02cd9b9ae0b5ca3b0dfdd341864ea82221241a5d811b1569fd0bfd71decdf7288","first_seen":"2026-01-18T21:01:20.389811Z","last_seen":"2026-01-18T21:01:20.389811Z","times_seen":1,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":236,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.627Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cashbackonsol.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 48532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 18:23:04 GMT\r\nexpires: Sun, 17 Jan 2027 18:23:04 GMT\r\ncache-control: public, max-age=31536000\r\nage: 95867\r\nlast-modified: Tue, 09 Sep 2025 18:33:50 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":48532,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 48532, version 1.0","md5":"225835e6e0496c54dc2aca9f3d533892","sha1":"942ef5298bbe74bfe44e445def5f2bfc94027fa8","sha256":"acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087","sha512":"ea2ff96ed5ac965c1846b4b33990beab3d4ced66806fa44321f5dd59d9a29a8ae1a67a5816d40165af8a896677b6a24bb74ea6db53cd5e686080165db9fd62c2","ssdeep":"768:b9tYsJ6BxVEpu8sqEkvfXRGEBqH7KxpxA07hQv2bSokjQx2AOWUVOv7UeFHOpIsR:LsEcy7fXRGqqHmr7qv32UC7UetOGLkF","tlshash":"03230178cf9f85b3d33b153afaf4d20562a9067de76c4a803831051a2a55770b89dc0e","first_seen":"2025-05-29T17:27:56.345238Z","last_seen":"2026-08-13T20:51:40.568999Z","times_seen":258246,"resource_available":false,"data":null}},"time_used":404,"timings":{"blocked":196,"dns":0,"connect":10,"send":0,"wait":8,"receive":3,"ssl":184},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cashbackonsol.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 11:04:02 GMT\r\nexpires: Sun, 17 Jan 2027 11:04:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 122209\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18720,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-08-13T19:24:09.455974Z","times_seen":11512,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":57,"dns":0,"connect":0,"send":0,"wait":18,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/team6-DPDdh9tS.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.348Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/team6-DPDdh9tS.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8214\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"2016-19a6de733cd\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W02Elv3IvIo2JxSyKiMiWSCOsal8sEqzcJTuXixGoi8TvVT67n9pGBCTqnd5TUm6EYpO%2BzjdoiETL6%2FZJkByLl5nOFrUupkt8UXGIIE8x5I%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b855684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":8214,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 469x366, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"106346b52f0e79cf65e5797214814309","sha1":"b3286a0b801de4f708cddf167882cffb5a39acdd","sha256":"2fc5852f9b6922ad875c80728de7e6604eeb7d35f61e58e1f4d9792646157326","sha512":"92863cac1441e454f4c3e6f0cb975884a6443865f22c1833efe36bff4e43981e49332d6f5387d11921aeb6d42f7bdacb94784d0e4bab07f73bc9fb82681c9598","ssdeep":"192:YietsKj+KdrddiOxpfCrZPx+8dkagO7k4E2N/Vb0B:YftPrdIOxlCx5er4hN/VQB","tlshash":"ae02af1c4ab88529a767f0f632f4611df53f91f9d1a9ee220d42d16aa326c11d36c788","first_seen":"2026-01-18T21:01:20.391854Z","last_seen":"2026-01-18T21:01:20.391854Z","times_seen":1,"resource_available":false,"data":null}},"time_used":275,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":273,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/b1374a7d228afed6bd69ae74d8d3ad49c56643c5.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.358Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/b1374a7d228afed6bd69ae74d8d3ad49c56643c5.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6996\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"1b54-19a6de733b1\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jrAECfwNiAaTb0y%2BZTAcTQmBVbBh46shqUsTrNe3AbEmNICDurNw8LaKGANEqKlkcNVrz2RsizEfpSiZgP6KYWcOMxbALsBnkHU3dqKultg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b8b5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6996,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c981896a7030e950d0c3bd5c5a14493e","sha1":"66ad6c2c991c9d6a81c6dd29a25db37b150d055c","sha256":"ffd6a0499ede471dd4f52430accc9e18fcbc46a365d85cedfe3e4c8a03376656","sha512":"1fb354cc460e8194c34825882bdec8ec3aa79bd09833be968ba957facf5e12a15405a2b8e7520c6ed31589bed416bcfa76def00f1e7e5c9cc81842fc8030c4ef","ssdeep":"192:SvemJ2cd5Jv5Rje8hoednRUkxYfOoe8HYKpLv:SSAfh7XVbRgLv","tlshash":"e7e1afdfab5e1a3e914738c2342bb8cfec538ec40aa617e156b87415505a9b3b87c450","first_seen":"2026-01-18T21:01:20.393967Z","last_seen":"2026-01-18T21:01:20.393967Z","times_seen":1,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cashbackonsol.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 11:04:02 GMT\r\nexpires: Sun, 17 Jan 2027 11:04:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 122209\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18720,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-08-13T19:24:09.455974Z","times_seen":11512,"resource_available":false,"data":null}},"time_used":172,"timings":{"blocked":76,"dns":3,"connect":22,"send":0,"wait":17,"receive":1,"ssl":45},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.21.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.645Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 03 Dec 2025 15:53:13 GMT","end":"Wed, 25 Feb 2026 15:53:12 GMT"},"fingerprint":{"sha1":"5A:E3:E3:B6:18:F9:10:0B:5B:11:FA:CB:BF:0C:9B:5C:0E:34:70:78","sha256":"FC:46:B0:C1:1E:B2:21:60:D9:7E:6A:ED:42:56:B2:CF:2A:E4:D2:F1:1C:63:63:98:2B:A3:0F:6C:4A:98:74:D6"}}},"request":{"raw":"GET /s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7W0I5nvwUgHU.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://cashbackonsol.cyou\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18720\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 17 Jan 2026 11:04:02 GMT\r\nexpires: Sun, 17 Jan 2027 11:04:02 GMT\r\ncache-control: public, max-age=31536000\r\nage: 122209\r\nlast-modified: Tue, 09 Sep 2025 18:30:42 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18720,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18720, version 1.0","md5":"2c753ee2983cf76ffeefa20db25a70c3","sha1":"13e20767faf339db1eb3b75b329e00f6d1b483fe","sha256":"28d124cbfadb7765f74a5688577c956ea3dd70f585b4645b2dc132742cd4c319","sha512":"0c9d6b356984e0f502a4a7ed99aef38621a53a580ceab2f1cb3f4f8d923f295891db0aac9eb2563541369a517e53def5b883a846eac8e138c169cd913044c8d7","ssdeep":"384:bNd6oCG7QqLLDPkev3w0zjoO9ETU1yZHG+2EuEn3iQ4:ZwozcqLLDM8Xf9ETU1yIzEuE3il","tlshash":"8982d0c11485e23c8e7c9ebb6a54f2b3acdb1238fed4371437127796504845b947a8bb","first_seen":"2025-09-10T18:13:11.027375Z","last_seen":"2026-08-13T19:24:09.455974Z","times_seen":11512,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":71,"dns":1,"connect":27,"send":0,"wait":20,"receive":1,"ssl":42},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/3066aabd21889aa6b62d3c86837c6fcac484b39d.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.360Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/3066aabd21889aa6b62d3c86837c6fcac484b39d.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6660\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"1a04-19a6de733a5\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ns9hIkfOQt8r7fBjs%2Bbywqv4rCv%2BKxf2GzKOPDW88uclcnLhq1M9A2AfZNsMTJ8jq9Kkvkxx81jAWVHU6bqsV5prttskh9if9QCfYz7pzPo%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e8b8d5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6660,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0ea06dad5c8af34036e56153eb11d3d3","sha1":"57491ae0a64a08cfd18e0064cd406542a54f0fbd","sha256":"7bc6794aa7c07c7ebdcb57dd1b13c10824f8a4d26b43d45ac7920fbe5d7a5902","sha512":"a80810724220a195145a26f4236ca0e6bee5d57d2c81c0201a69a870ff2d8ece1e9c115e8dfcbe7f3fdfae8b97b1c1bbcc061407bcd096b829cc3bec2b1734b8","ssdeep":"192:Y2O7/nDdzo9gd3G7hLEovc1WlOE+7f5sU4aYwbl:XO71oyd27RPv/lOR7CU4sl","tlshash":"45d19e8e5471294985bcdb9403a19c94e297416ac5ceb8b64d0690bee27bc478c1d276","first_seen":"2026-01-18T21:01:20.396021Z","last_seen":"2026-01-18T21:01:20.396021Z","times_seen":1,"resource_available":false,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":264,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/33-1yWRRjf1.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.375Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/33-1yWRRjf1.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 194794\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"2f8ea-19a6de733a9\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=191hRsr%2FIxyJtUQNMS7SS3RCor%2FJoA0U73K8cB%2FTcOpUtYDuNUxXWrQoclS%2Bx0e2PoCEXzxZVrYj9F3UQNgxfJs%2FIe9RIp7xjfToWeJeqYA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062eab995684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":194794,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9397d4928f0cafd4eaa70ef0e5ef3ebf","sha1":"13bf07b529d12c59d0074cb1ad44716aa142765b","sha256":"f01853c75e1a6ca23a71c648b20c24458d00148769b4401c18670f7183b2ba4e","sha512":"32dd94c19e52123eadf0ef747cd017f9ee4222ab573723e7ab50f478e0c8fe8659ea840ee003909df19f11fd6a41301ae9330223343e5634c76f4375e7889439","ssdeep":"3072:VCBDmpgeQkVuncTg4PXu24y46T4e9DEEbpLTIKXzmzrnbmn0SlG+UGGWrhigCkSq:VC12gmVvxXZ4bHe9DEEbBIKXCzrmcGGG","tlshash":"01141308c45928d6caef2cfa7339d69a9684346ed7a5ccc437d0c2c93941dfaa3f8594","first_seen":"2026-01-18T21:01:20.398125Z","last_seen":"2026-01-18T21:01:20.398125Z","times_seen":1,"resource_available":false,"data":null}},"time_used":587,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":292,"receive":295,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:51.483Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2 HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/2e0uj.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:51 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 18740\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"4934-19a6de733d8\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\nage: 0\r\ncf-cache-status: EXPIRED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3nw0xq475mnLuGFkTC8aI8F%2FMgdiv2GyQKHjshNTYQs8X%2FNzg5D0Oz%2FoGFhmyPrin03YTxhq2Sb2S9P5j66lFkFpDN2PAA8g72uzi9s2lJg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c010635cc8a5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":18740,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18740, version 1.0","md5":"06ab411342acdbfe3e746ee904e12cc5","sha1":"d83a47942575eeb80d30ebc7bf9a5b6f83c930fb","sha256":"62cc01daef72c3ea76a258445368d2f4ab8d05a91f91c53fd12f7c42e3325942","sha512":"6dc7ae210dc6578115ac9a4b78431be0f3f767684d3088ff5cd8094d1ce37756ce606571f325e6c97757dffe012d491792efac56efce2fb7a4fce9a7137cfc19","ssdeep":"384:AtbXebWepTmCSQiXLGg63eWz5WkPvRhc4Xci8yxpMNG:Adfeg9LGgHa3vRhj58yQNG","tlshash":"b082d05018f7583df26d8ab0279bb89e1b19bb7ff601d48e41319d4318f193846578af","first_seen":"2024-08-01T04:50:43Z","last_seen":"2026-08-13T14:22:34.864686Z","times_seen":962,"resource_available":false,"data":null}},"time_used":357,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":272,"receive":85,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/ohsnap.css","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.302Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/ohsnap.css HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 500 Internal Server Error\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: accept-encoding\r\npriority: u=2,i=?0\r\ncontent-security-policy: default-src 'none'\r\nx-content-type-options: nosniff\r\nx-powered-by: Express\r\ncf-cache-status: BYPASS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fIlaTQYdawJIeEEmxidsk%2Bd4qzBN3yNVjT6BODVHbvVZ9faynEK4znA5flB0LeWUj3X3ennRDFwj3gd4Mno7lza7RmVHVv%2BmLdv03vlDI4k%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c01062e4b755684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-13T20:51:55.920032Z","times_seen":17875984,"resource_available":true,"data":null}},"time_used":235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":235,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/team2-CTL725D4.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.342Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/team2-CTL725D4.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6712\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"1a38-19a6de733cc\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PLLvj9Yw1HFDzXM1Ob5QMH2RzGJtbclFQVHx4leRR2Ugy0K7JEqqSzlDdUE99Qst9y8Bji05mIt%2FwiQws0NlwLqYo74S0oJVldPqt%2FYq%2Fe0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e7b7e5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6712,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 468x366, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fcc735feaa5f42059d6c771b31a91c38","sha1":"f557b82918d9b125b92a8e6c3216afbc6b1364da","sha256":"5ef031f4b2fdabb407f6d0d39cc7ef5f3f227bc57138f856cd6b00b1c5c4a6cc","sha512":"7e58b4af9a031e6539691c226f84d310a22d54239a41d8b157023f0910a9391d88753c6024d8cf4d95c75c91c87df319b4a07b8d23a642c1188eb3404ab91666","ssdeep":"96:5w9L8OUYEqCfNZz1+CdJNJ3/hq6KELJTwFdN5q582jiMIzVnooLafeYZqu1BWZIU:Gbb+fNZoCf/tpLJTkN5RnVafe3u1q","tlshash":"d5d18e4271eadbc7b7d5c0f126292a957d260499368617a1c9e394ccca6b2fe07d0cd3","first_seen":"2026-01-18T21:01:20.399841Z","last_seen":"2026-01-18T21:01:20.399841Z","times_seen":1,"resource_available":false,"data":null}},"time_used":247,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":246,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/amlsafe-Dapxivrv.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.367Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/amlsafe-Dapxivrv.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 144892\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"235fc-19a6de733b0\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Zb3k6O1fJZiNYPBDB72L3fsDRgUtaaDXaQXSqibr%2Bwb0AexqHAVU%2BSfV1jj8jDMZmd8XuIks9%2B3I9SRm71n3g1574ApoZyT9e3M5r3HweEM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e9b915684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]}],"data":{"size":144892,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8af93f431daf83fc333b19f5314c2b1a","sha1":"b1f438906716a3de7919e97f0f25a4277d362dea","sha256":"5e8165b8dd0500ba75ed374ce379452de9566f0cd5781443355a3841aa10a982","sha512":"b29aa6f42b18dd69d2d731e5b1dc114e1f2c9806b06b96ed640fd2716463a14c1f4f98491e7b8e6418919adb3d8eb72fc5aaeed59d60f420997a726e2adfcc0f","ssdeep":"3072:aBWVH/URRKwIXPdmP6K8FhPPKcuF6DUkDbT4gQx/3aIzIlTAYu1PMtzD:aBK6oPJJ77ue1PToxPFAADGD","tlshash":"4ee31398c5de2855afc110797527603b6c20c2ac0fda2a3e38dff0379ae98d58ed4909","first_seen":"2026-01-18T21:01:20.401583Z","last_seen":"2026-01-18T21:01:20.401583Z","times_seen":1,"resource_available":false,"data":null}},"time_used":605,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":307,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/65c82043c70f0ca23e677d31cb87d970f71f2130.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.372Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/65c82043c70f0ca23e677d31cb87d970f71f2130.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8264\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"2048-19a6de733ac\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VrCD9LZjP9%2BIvzA%2BeU0WbJpM8%2BlWc6EVw80VO5GfDT8wIsNe9UfoHEp%2FEFlHRwK7n8keGOxNyr2O49Meo1DVqyQ58qf%2FNlOqR3EC21wAEdQ%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e9b965684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8264,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7468898fc7aece75c4a6784c456a1d6a","sha1":"76f36ba6a101c1635e69aaac0c20b11743605f03","sha256":"2f367400a7e5b5e1ca5beb570cdc2154125b0703c59dd50a08e61f3813e14f47","sha512":"573b36bb501ebba5d6b1e59e3ca96253c242470c93041a1adfd3d9f8a40ea9e0d246f0abc0095f184c9bc934c8a18a1bb7ea14f69af07063547900e423e0e99d","ssdeep":"192:CET1++/YVLcN88gtQzOTRlT6/IDkTXJo2W:dT1++/kIN88Pz47TfQT5o2W","tlshash":"6b02afde4c070e1396ec9dada3fcad85b60da43da652936140a8d771c4f25361713c6d","first_seen":"2026-01-18T21:01:20.403301Z","last_seen":"2026-01-18T21:01:20.403301Z","times_seen":1,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/css2","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.551Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /css2 HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/l/aml_1741265414/index_files/m0izv.css\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 15903\r\npriority: u=2,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=0\r\netag: W/\"3e1f-19a6de73375\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=L%2B%2Bqjb2Qgo4n6vdE%2FhMLechtgAOnqqFAlNmzIeMqbVfFLtFue5ZDKeYx783mFh3CfV9745LZq0tvoVOFwPo%2FCIYp%2Fcf8vBYIMBTSgB3cNK8%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9c01062ffba55684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":15903,"size_decoded":0,"mime_type":"application/octet-stream","magic":"ASCII text","md5":"4d2a60e524f4d7e96ee0b8e96dfd7a17","sha1":"8753a81c36875ca1e6a257af4dc3dab19b20b8fd","sha256":"15dd8cd4a5cb688fa97a2f0983c1e1ada8058905c0f2aa2260e2b3318d17707d","sha512":"c7d2f3aa6afd6d9f66870872a1faa65c127ac70e9914490ff6123197d20d6b33b0f15057ef38af7c439569bc2fde2d8310e770592b8ef7e56cec337df46f81b3","ssdeep":"192:NpMdpOopBpfPpKXM2OhCfYKwMVOyxffK9MoOTcfmK+MvOMjfFKbMSO1mfcK0MBO/:NGdMoL95XqAaF6GiLq0aJaa0","tlshash":"20628a402457a600e6472cc927cf3f269d5d7262b499c9393ffe2868bdeec251365b2c","first_seen":"2026-01-18T21:01:20.404999Z","last_seen":"2026-01-18T21:01:20.404999Z","times_seen":1,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cashbackonsol.cyou/l/aml_1741265414/index_files/what-else2-c8YgOWn0.webp","fqdn":"cashbackonsol.cyou","domain":"cashbackonsol.cyou","tld":"cyou"},"ip":{"addr":"172.67.157.197","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cashbackonsol.cyou/","date":"2026-01-18T21:00:50.337Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cashbackonsol.cyou","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 22 Dec 2025 13:49:36 GMT","end":"Sun, 22 Mar 2026 14:48:08 GMT"},"fingerprint":{"sha1":"60:76:8B:9D:86:98:87:8A:D5:CA:3C:B0:8E:AB:E2:25:3B:A4:87:2F","sha256":"F7:0D:08:35:5C:5E:38:2F:48:46:DA:68:96:84:65:2D:07:86:0A:F5:BA:E6:BA:B5:77:64:B4:49:20:33:88:02"}}},"request":{"raw":"GET /l/aml_1741265414/index_files/what-else2-c8YgOWn0.webp HTTP/1.1\r\nHost: cashbackonsol.cyou\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://cashbackonsol.cyou/\r\nCookie: __clsess=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3Njg3NzAwNTAsImlkIjoiZjMwZDhmNzgtMTgwNC00MWRlLTk4ZDctOGJmZmVjZmQwM2I4Iiwic3RhdHVzIjoiaHVtYW4iLCJob3N0bmFtZSI6ImNhc2hiYWNrb25zb2wuY3lvdSJ9.r_eQDsf7NYytknsUw5zqoSVAWG-_WIJefflZrlipxSs\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sun, 18 Jan 2026 21:00:50 GMT\r\ncontent-type: image/webp\r\ncontent-length: 121506\r\npriority: u=4,i=?0\r\naccept-ranges: bytes\r\ncache-control: public, max-age=14400\r\netag: W/\"1daa2-19a6de733d6\"\r\nlast-modified: Mon, 10 Nov 2025 13:14:19 GMT\r\nx-powered-by: Express\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=QfcTJ1ZlpZV5%2BYIswk0MCQmrSSLtNHCK2C%2FLvpxLzqSJR0PRq8B5ofcwqW3Xn290FM6l%2B%2F5w0kEym2P0iwJZgMJZ2ZcxR3nT7FCzWJuSSmg%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\ncf-ray: 9c01062e7b7c5684-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":121506,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bb9195a94db5fe19387a188b87ef1fd2","sha1":"10ce0f531b94d99b0cec28953fad4bb10ebe6e84","sha256":"6fe1743501d5a2980d183580666b0594a42a8f02568b1e405641bbc677f486ba","sha512":"0edfecc42df52e1cbb7704684a7c51fd4b9678da6f731c4bfa92dc696ac7a05556155078ab7b01f42eabb981847324ed1927899297185a9572d6ee7896b2190a","ssdeep":"3072:/hots2PB0d3yL6UV95NOjJALMwq0usbr/0l9R:/ks2PGcuUjWAge7qR","tlshash":"81c3122081e2e7749e8ca7490cc54aa78a4d82fc61978d1cc0d76f9b8f5557ff292e32","first_seen":"2026-01-18T21:01:20.406637Z","last_seen":"2026-01-18T21:01:20.406637Z","times_seen":1,"resource_available":false,"data":null}},"time_used":487,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":228,"receive":259,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-18","alert":"Sinkholed","trigger":"cashbackonsol.cyou","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}