{"report_id":"637fa43b-d9e1-4bff-966a-33616192ad80","version":6,"status":"done","tags":[],"date":"2025-10-18T16:01:13Z","url":{"schema":"http","addr":"jxauee.com","fqdn":"jxauee.com","domain":"jxauee.com","tld":"com"},"ip":{"addr":"109.104.154.97","port":0,"asn":136258,"as":"BrainStorm Network, Inc","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"jxauee.com/","fqdn":"jxauee.com","domain":"jxauee.com","tld":"com"},"title":"atfx"},"submit":{"url":{"schema":"http","addr":"jxauee.com","fqdn":"jxauee.com","domain":"jxauee.com","tld":"com"},"ip":{"addr":"109.104.154.97","port":0,"asn":136258,"as":"BrainStorm Network, Inc","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-22T16:01:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":30,"urlquery":0,"analyzer":3}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:43Z","timestamp":1760803243,"ip_dst":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":38290,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2025-10-18T16:00:43.760849+0000\",\"flow_id\":652747949690247,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":38290,\"dest_ip\":\"154.92.255.156\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"pc.atfx-iij.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":917,\"bytes_toclient\":3551,\"start\":\"2025-10-18T16:00:43.347527+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34286,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.195200+0000\",\"flow_id\":2094628601058948,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34286,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":907,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.841348+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34296,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.200384+0000\",\"flow_id\":39864707045208,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34296,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":753,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.841560+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34310,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.230233+0000\",\"flow_id\":1138555996034891,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34310,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":753,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.874315+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34320,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.237269+0000\",\"flow_id\":2068111472948997,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34320,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":907,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:51.882437+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34334,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.248449+0000\",\"flow_id\":1242034643117879,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34334,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":907,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.894775+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34338,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.270772+0000\",\"flow_id\":1503632511143319,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34338,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":907,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.920983+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40678,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.089534+0000\",\"flow_id\":2103012377285401,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40678,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":903,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:52.578329+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40652,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.095542+0000\",\"flow_id\":966121649120695,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40652,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":753,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.566711+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34372,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.106483+0000\",\"flow_id\":2016537505733509,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34372,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":753,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.564101+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34392,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.108868+0000\",\"flow_id\":368129057529078,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34392,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.564470+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40656,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.111230+0000\",\"flow_id\":1617904411125357,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40656,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":753,\"bytes_toclient\":3148,\"start\":\"2025-10-18T16:00:52.566893+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40670,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.129723+0000\",\"flow_id\":548749612197608,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40670,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.567016+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40686,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.133888+0000\",\"flow_id\":1864319569768936,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40686,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":903,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:52.602600+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34374,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.150888+0000\",\"flow_id\":1783647199075397,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34374,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":903,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:52.564293+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40676,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.152110+0000\",\"flow_id\":1763929004222291,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40676,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":753,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.567123+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34402,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.153293+0000\",\"flow_id\":1350284998909267,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34402,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.564563+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34390,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.163544+0000\",\"flow_id\":662995742268575,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34390,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.564383+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34418,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.175917+0000\",\"flow_id\":965301310365094,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34418,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":753,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:52.564646+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34446,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.331011+0000\",\"flow_id\":1461125219906234,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34446,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.815802+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34454,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.349885+0000\",\"flow_id\":1242369650619155,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34454,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.815891+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34430,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.364553+0000\",\"flow_id\":1645448036380973,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34430,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.815405+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34424,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.370349+0000\",\"flow_id\":2104313752350851,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34424,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":753,\"bytes_toclient\":3148,\"start\":\"2025-10-18T16:00:52.815235+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40694,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.380656+0000\",\"flow_id\":61657371146823,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40694,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":753,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.817735+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40728,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.402904+0000\",\"flow_id\":34392918726866,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40728,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":753,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.858322+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34442,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.411103+0000\",\"flow_id\":307763292172886,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34442,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.815702+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34436,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.416996+0000\",\"flow_id\":339820928070117,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34436,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.815589+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40712,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.431010+0000\",\"flow_id\":2082924815219518,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40712,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":753,\"bytes_toclient\":3148,\"start\":\"2025-10-18T16:00:52.817982+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40722,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.478655+0000\",\"flow_id\":142737763761062,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40722,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.818086+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40704,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.488606+0000\",\"flow_id\":1739142747945681,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40704,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.817873+0000\"}}"}],"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"mitradel.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.da-meat.com","ip":{"addr":"35.201.164.148","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Taiwan","country_code":"TW"},"domain_registered":"2019-01-09","domain_rank":0,"first_seen":"2025-10-18T16:01:19.480508Z","last_seen":"2025-10-18T16:01:19.480508Z","alert_count":0,"request_count":1,"received_data":682387,"sent_data":485,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]},{"fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"domain_registered":"2012-04-01","domain_rank":0,"first_seen":"2025-10-18T16:01:19.472714Z","last_seen":"2025-10-18T16:01:19.472714Z","alert_count":0,"request_count":23,"received_data":5815936,"sent_data":10827,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}]},{"fqdn":"s2.flink2.com","ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-12-02","domain_rank":0,"first_seen":"2025-06-04T04:07:02.979761Z","last_seen":"2025-10-11T06:36:21.313098Z","alert_count":0,"request_count":19,"received_data":44079,"sent_data":8977,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"echo-pro.oss-cn-hongkong.aliyuncs.com","ip":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2012-04-01","domain_rank":0,"first_seen":"2025-08-09T00:35:23.566525Z","last_seen":"2025-08-09T00:35:23.566525Z","alert_count":0,"request_count":6,"received_data":1494,"sent_data":2940,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}]},{"fqdn":"media.nownews.com","ip":{"addr":"54.240.174.111","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2003-10-29","domain_rank":1430780,"first_seen":"2020-05-05T04:58:33Z","last_seen":"2025-10-08T22:11:15.829868Z","alert_count":0,"request_count":1,"received_data":87298,"sent_data":486,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}]},{"fqdn":"echo-res.oss-cn-hongkong.aliyuncs.com","ip":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"domain_registered":"2012-04-01","domain_rank":0,"first_seen":"2023-05-24T09:03:08Z","last_seen":"2025-08-04T13:33:36.260045Z","alert_count":0,"request_count":7,"received_data":1589,"sent_data":3430,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}]},{"fqdn":"mitradel.top","ip":{"addr":"172.67.216.30","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-04-29","domain_rank":0,"first_seen":"2025-10-18T16:01:19.47404Z","last_seen":"2025-10-18T16:01:19.47404Z","alert_count":2,"request_count":2,"received_data":163245,"sent_data":883,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.harvestplus.org","ip":{"addr":"172.67.181.244","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2003-07-17","domain_rank":0,"first_seen":"2014-02-13T00:36:17Z","last_seen":"2024-03-28T03:59:27Z","alert_count":0,"request_count":1,"received_data":464381,"sent_data":474,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"jxauee.com","ip":{"addr":"109.104.154.97","port":443,"asn":136258,"as":"BrainStorm Network, Inc","country":"The Netherlands","country_code":"NL"},"domain_registered":"2018-02-06","domain_rank":0,"first_seen":"2025-10-18T16:01:20.43905Z","last_seen":"2025-10-18T16:01:20.43905Z","alert_count":0,"request_count":2,"received_data":4454,"sent_data":906,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"webapi.44845.icu","ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-10-04","domain_rank":0,"first_seen":"2025-10-18T16:01:20.215698Z","last_seen":"2025-10-18T16:01:20.215698Z","alert_count":89,"request_count":91,"received_data":133998,"sent_data":52978,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"pc.atfx-iij.icu","ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":28,"request_count":29,"received_data":41721922,"sent_data":13298,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Vue.js:2.6.10","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Axios:1.0.0","description":"Promise based HTTP client for the browser and node.js","website":"https://github.com/axios/axios","common_platform_enumeration":"","icon":"Axios.svg","categories":["JavaScript libraries"]}]},{"fqdn":"upload.wikimedia.org","ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"domain_registered":"2003-03-16","domain_rank":4329,"first_seen":"2012-05-21T09:39:45Z","last_seen":"2025-10-12T23:15:16.501791Z","alert_count":0,"request_count":8,"received_data":144602,"sent_data":4080,"comment":"","tags":null,"fingerprints":[{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}]},{"fqdn":"www.orientalkopi.asia","ip":{"addr":"103.6.245.189","port":443,"asn":132198,"as":"iCore Technology Sdn Bhd","country":"Malaysia","country_code":"MY"},"domain_registered":"2023-03-16","domain_rank":1023800,"first_seen":"2025-04-28T04:40:45.542902Z","last_seen":"2025-04-28T04:40:46.434685Z","alert_count":0,"request_count":1,"received_data":772606,"sent_data":590,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:43Z","timestamp":1760803243,"ip_dst":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":38290,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2025-10-18T16:00:43.760849+0000\",\"flow_id\":652747949690247,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":38290,\"dest_ip\":\"154.92.255.156\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"pc.atfx-iij.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"15af977ce25de452b96affa2addb1036\",\"string\":\"771,4866,43-51\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":917,\"bytes_toclient\":3551,\"start\":\"2025-10-18T16:00:43.347527+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34286,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.195200+0000\",\"flow_id\":2094628601058948,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34286,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":907,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.841348+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34296,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.200384+0000\",\"flow_id\":39864707045208,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34296,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":753,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.841560+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34310,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.230233+0000\",\"flow_id\":1138555996034891,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34310,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":753,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.874315+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34320,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.237269+0000\",\"flow_id\":2068111472948997,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34320,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":907,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:51.882437+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34334,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.248449+0000\",\"flow_id\":1242034643117879,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34334,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":907,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.894775+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:52Z","timestamp":1760803252,"ip_dst":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"ip_src":{"addr":"172.18.0.16","port":34338,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:52.270772+0000\",\"flow_id\":1503632511143319,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34338,\"dest_ip\":\"47.79.48.215\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"sdfwewaef.oss-ap-southeast-1.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":907,\"bytes_toclient\":5965,\"start\":\"2025-10-18T16:00:51.920983+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40678,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.089534+0000\",\"flow_id\":2103012377285401,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40678,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":903,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:52.578329+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40652,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.095542+0000\",\"flow_id\":966121649120695,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40652,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":753,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.566711+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34372,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.106483+0000\",\"flow_id\":2016537505733509,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34372,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":753,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.564101+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34392,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.108868+0000\",\"flow_id\":368129057529078,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34392,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.564470+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40656,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.111230+0000\",\"flow_id\":1617904411125357,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40656,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":753,\"bytes_toclient\":3148,\"start\":\"2025-10-18T16:00:52.566893+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40670,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.129723+0000\",\"flow_id\":548749612197608,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40670,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.567016+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40686,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.133888+0000\",\"flow_id\":1864319569768936,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40686,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":903,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:52.602600+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34374,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.150888+0000\",\"flow_id\":1783647199075397,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34374,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":903,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:52.564293+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40676,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.152110+0000\",\"flow_id\":1763929004222291,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40676,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":753,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.567123+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34402,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.153293+0000\",\"flow_id\":1350284998909267,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34402,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.564563+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34390,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.163544+0000\",\"flow_id\":662995742268575,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34390,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.564383+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34418,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.175917+0000\",\"flow_id\":965301310365094,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34418,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":3,\"bytes_toserver\":753,\"bytes_toclient\":1634,\"start\":\"2025-10-18T16:00:52.564646+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34446,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.331011+0000\",\"flow_id\":1461125219906234,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34446,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.815802+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34454,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.349885+0000\",\"flow_id\":1242369650619155,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34454,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.815891+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34430,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.364553+0000\",\"flow_id\":1645448036380973,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34430,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":903,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.815405+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34424,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.370349+0000\",\"flow_id\":2104313752350851,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34424,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":753,\"bytes_toclient\":3148,\"start\":\"2025-10-18T16:00:52.815235+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40694,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.380656+0000\",\"flow_id\":61657371146823,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40694,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":753,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.817735+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40728,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.402904+0000\",\"flow_id\":34392918726866,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40728,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":753,\"bytes_toclient\":4662,\"start\":\"2025-10-18T16:00:52.858322+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34442,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.411103+0000\",\"flow_id\":307763292172886,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34442,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.815702+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":34436,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.416996+0000\",\"flow_id\":339820928070117,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":34436,\"dest_ip\":\"47.79.66.63\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-res.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.815589+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40712,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.431010+0000\",\"flow_id\":2082924815219518,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40712,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"650c82854aed91a22996035b295a0c3e\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":4,\"bytes_toserver\":753,\"bytes_toclient\":3148,\"start\":\"2025-10-18T16:00:52.817982+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40722,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.478655+0000\",\"flow_id\":142737763761062,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40722,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.818086+0000\"}}"},{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2025-10-18T16:00:53Z","timestamp":1760803253,"ip_dst":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"ip_src":{"addr":"172.18.0.16","port":40704,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"low","alert":"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)","source":"{\"timestamp\":\"2025-10-18T16:00:53.488606+0000\",\"flow_id\":1739142747945681,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.16\",\"src_port\":40704,\"dest_ip\":\"47.79.64.157\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2052581,\"rev\":1,\"signature\":\"ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)\",\"category\":\"Misc activity\",\"severity\":3,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2024_05_14\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"tag\":[\"TA_Abused_Service\"],\"updated_at\":[\"2024_05_14\"]}},\"tls\":{\"sni\":\"echo-pro.oss-cn-hongkong.aliyuncs.com\",\"version\":\"TLS 1.2\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"5d79edf64e03689ff559a54e9d9487bc\",\"string\":\"771,49199,65281-0-11-16-23\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":6,\"bytes_toserver\":903,\"bytes_toclient\":5918,\"start\":\"2025-10-18T16:00:52.817873+0000\"}}"}]}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/element-ui/2.15.6/index.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"693f98461ce3fa58cbe5ac24d9a21b1e","sha1":"93661cc05514da433809e79f229815ae1ddbee77","sha256":"24ebdea828e938d3a45128b41979b320b4cbd40c8c0d4bad6a9cd9bc3bfa4e0c","sha512":"2dab95b96bfccc9f78069504b006adc198531831c53c81b23b8d05163428f0a66beefe7d466452e7142cbe98419e36d327b20ab24dd3c25a05de9f9363e05d3e","ssdeep":"6144:B4lry61ETrc+kymEidUVM+u0kXzVXsnDBH7SuLH8isMZgS7Lu5:2U61Wrc+kymEiuVM+k9uVHOuD7Lu5","tlshash":"d3c41b8d72c1b5314ba36070503f250bb33b299c680980dcb679d8ea6dbd949526ffbd","size":586253,"data":"","first_seen":"2023-03-07T13:53:00Z","last_seen":"2026-08-02T04:27:23.770802Z","times_seen":561,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/js/app.725f380b.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"994306c124fe3c538448f0156cfd9bc6","sha1":"fb6ff3f282bdf2b43ac3a43a039357c8e1e9528c","sha256":"a36893fa2e2c4fd9fb0649a818616f0d0f424c2d08fffeb1bb9456cec0dd4a7e","sha512":"a1caa403d2a584c2132ccabb556a2364ed8dae6b04a35bff4eeb465887b0c4ab94c872aa6ebc9ff77bc626a7dc7ab73ce557b1f119f29fae8b182fe8f11e1c2b","ssdeep":"12288:rXORKyUJowkdg1Eo3pyMC6bLQUXPG6neZfi9k6YX1glziyh0C5yESES:rX6K9wCzv5yEST","tlshash":"e5a43c7a2d8ae8e825552390204fb635b1ac9c95bf8de4c117b8c2cb71fe914f017b67","size":461839,"data":"","first_seen":"2025-10-18T16:01:39.885581Z","last_seen":"2025-10-18T16:01:39.885581Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/js/views.c11f0758.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"2047192fd994ef3c2100e8382a449c85","sha1":"613b66f7f12c4cd99f0bbf3f1fdc4d074963243a","sha256":"c582985abf27d96041d61b23c4b15fc26dc62f96a14b7d09f2a9b620cd395368","sha512":"7c0ebf8b2089dca9589b6a2e9b87abade3400cc678fc21041529b4b273713616b99f7838941052be85990b2ed33a98fe9e31755e80cdab951f2b58a4d7a7014f","ssdeep":"49152:DkqKsiYsiFjusm4EjE8xdsZKmL3IMEmgi1:2Ldw","tlshash":"e0d5f884b291b056c69e2650042f510ae279be6c780b806df735dcf77de8a84762ef3d","size":2998533,"data":"","first_seen":"2025-10-18T16:01:39.890996Z","last_seen":"2025-10-18T16:01:39.890996Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/vuex/3.1.1/vuex.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"ccce53cbb3813a63f1420eba489574af","sha1":"94ac9c787b2b96236356286c44350260c9f08a33","sha256":"1610512a47faf745fe96ac631be8ea3ea50a222fe7d7cca691f7ff8194b934bc","sha512":"78a2cf9dd160d4a451c1536de4d0037330d8ed11d07f0edaa427de7131a190af3c86d1a3f5bd858cac14f16ca70f78b2dc4bbe0124f7d3a2a4cce8872b95b8bd","ssdeep":"192:ViDaQv4w9nWp4UvouC3Dqs/778IG0zqLVFcu8XCnrdVpVAQflmGcXg3H8VnbZqlp:VeJgqnWp4kYj78p16CrdKMQ0CbMB+a4+","tlshash":"6a32cb9a73e1762aca57b0b0ac5f9c08f275a9dc1686400c6a4dc0f99c754bccb7ed9c","size":11653,"data":"","first_seen":"2023-08-28T22:21:58Z","last_seen":"2026-07-30T19:42:39.876395Z","times_seen":282,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/vue-router/3.0.1/vue-router.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"a7656f4be720b1580847f9783d6ab4dd","sha1":"d3582fc6fb317199378638d2a12b4186fdee19eb","sha256":"9d5542c396b2102deb7390b39061aa7ae35f9329dfab9a34823cf84396b8cc13","sha512":"e31c23718a86b6a46355b975f29854ad874351005a9c634a56cfe8f4126198be7d6ca67cd95ba24135ce8cceb3b6dd1b4eaa8f9d4aadfe4061210f4c7b8052b4","ssdeep":"384:Oxwp+JvwAmXRZOYQFoB5RKbKBpZn6ySH1DhUxjImhFVP:Fp+JvwAGjOYQFoB5RK+nnTMa/hXP","tlshash":"b0b2c69db582b03247d326a0816f150bf23b7999744e84a8f2a9f4d43cbd85e8427f7d","size":24555,"data":"","first_seen":"2023-08-28T22:21:58Z","last_seen":"2026-07-30T19:42:39.894177Z","times_seen":287,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/avue/2.9.5/avue.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"750459dc86246c289cdf5b760013f43b","sha1":"8103e042309fe4007cda921497f28410a75656ba","sha256":"5df0b88dacc1f9ae9edc0adc120da6190632e03cea789186cfc49d532918d6bf","sha512":"f9db639a43a21ca3a54d2546999e885bc0057f1b29eb9c2a1b7e5510dfd284530992a97c9642d4ed87357a472b7274b229279fdd45251ad9bc7c03564747375d","ssdeep":"3072:8mWzlkGK5sT4v9rD/2S4oqJNtvywiDjD7TefeKceKsT1/tF8vUoa:8mXqJNtvywiD37TefeKceKsT1/XBoa","tlshash":"50540959f1cab8750ad76070003f210af2372b896409d0a4b679d9e1adbce4da16ff7d","size":300353,"data":"","first_seen":"2025-03-06T09:16:43.423938Z","last_seen":"2026-07-30T19:42:39.885961Z","times_seen":249,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/js/chunk-vendors.d993d13c.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"dd7518f743fb34d6e5d50a377217305d","sha1":"393aced7cd6f6e618ffa1a5ce32fb23637117b38","sha256":"8f0ddc26b65d6c1346d7e8f95ac87ef126b477a8764fee901bfc4e4a3090baef","sha512":"f3bf29c489e5eb325d83579c8fb9a596aa2c1a6778df5afc69904a9c7a398587b7cc219561b83e2b71eaff4cc7215ded38936afac059c8e91466d5a69c903b22","ssdeep":"12288:lzTsNvT06I+Qmvv00k/ylrh3uIgowOhppKD58aSQgpwXmPnX49:pTsNr5zlrh3uIgowOhppKD5gQt0q","tlshash":"9805f7cdf2c6b0a513e774a5003f650bf23a6818784e8995f265e4d5bcb898e513bf38","size":801222,"data":"","first_seen":"2025-10-18T16:01:39.752557Z","last_seen":"2025-10-18T16:01:39.752557Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/#/","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"Function","is_inline":false,"md5":"74e14b947a4e6cd02eb3ab13b82ce793","sha1":"0012c49ba856ee2fad75f536a48235b67f008889","sha256":"cf3b90b3557025d192c0dfeb57a69850ef8ae9fb35aec51c8f55033e20f41944","sha512":"e746292c231e9b0a2b6a1f6a4234bdb109ca5c67e6f0b967224d695659b7c423650100dab1fe04ec6e2606cb4df4cd3117c7859f0652ed92af55754e1853fb3a","ssdeep":"","tlshash":"7df0ab93f5b909833458afa0dde898be75324277065d7f6ca7253c411fae028943856c","size":440,"data":"","first_seen":"2025-10-18T16:01:39.8963Z","last_seen":"2025-10-18T16:01:39.8963Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"jxauee.com/","fqdn":"jxauee.com","domain":"jxauee.com","tld":"com"},"ip":{"addr":"109.104.154.97","port":443,"asn":136258,"as":"BrainStorm Network, Inc","country":"The Netherlands","country_code":"NL"},"introduction_type":"scriptElement","is_inline":true,"md5":"ce04c14042d52524a4934d18c69f665b","sha1":"b76a36baf2a914f01de833fa620564e972692eec","sha256":"3c63b1ddce2faf1d8a36cbe70545e1963d4f2f523b5176e54b122a4e5413278d","sha512":"394a96607223f1e6e89a2be0b1f1651e2f2bf73cec013086008922c14a8096c9f6d56fed3102d49ff9c3dc3fefe894c48c89e972c64ba4c74ac7c875bf53b1d8","ssdeep":"","tlshash":"4951617b1d775911404b509c7756b8087120102f3d49c9a9bfbf8ab42fe1c5a28b29fe","size":2954,"data":"","first_seen":"2025-10-18T16:01:39.901387Z","last_seen":"2025-10-18T16:01:39.901387Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/charting_library/charting_library.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"8573e89d9ec535663d75f21b1f08109c","sha1":"a8d9eea0b157ceeffc38d4254e6f6abc9d697d10","sha256":"cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151","sha512":"55d728fa1e0682725f94b17387c6790792d3d34b43652a00097876118575bd6cefa20916d80674519005d72f20ecbb745e9645516c056e6f9bb6691d5efbcb33","ssdeep":"192:9fdWSo7ktFUnoBelr6lw2LfnzuIQPlaJ1i10K+Ei/ISJhvHIheu5Ph3Ffam:vWS2ktFUnoIlD2LfnqIJimK+5/ISJhvu","tlshash":"6e224f58ed2478720acb54f0427f180f8239e278d84944ed3cc4e6ec59fd44a6a6fbb8","size":10858,"data":"","first_seen":"2023-08-16T00:37:19Z","last_seen":"2026-08-02T16:01:39.462111Z","times_seen":1325,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/axios/1.0.0/axios.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"76235a7ee6b454034b80a390ccc92f37","sha1":"8a84e29a036660955f3ebc42d43bb522730b5707","sha256":"3c92bac09bac9bfd77f2ced65b63e009c9b67c109a9d37de637b3573d7ec7adb","sha512":"35c36d820651548001703c6458cfb922c55c12bd8c0ed73a8d095f0656e45c345e0f4fb2fe0e037d14009020dc38bed1e349d110b3f9f2f50dcfa0f05f8cbd08","ssdeep":"384:3ao8KGKMMT6nbNp0nkJFP5F0YS6DagzzNYT9eei:VGNp0EPb46DaT9e1","tlshash":"f242a7ce78a1b0d747f320f0905f5a0fb2b6992a644d84a0e560e8f66db546e8737f4c","size":12969,"data":"","first_seen":"2023-06-26T22:56:34Z","last_seen":"2026-07-30T19:42:39.812399Z","times_seen":334,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/vue/2.6.10/vue.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"17e942ea0854bd9dce2070bae6826937","sha1":"434cdec1669f2c6c7406297a72120936bc56ed52","sha256":"72194d152571dd375c4365e5c3b4af9db2c06af0102ced18fcb062597d38be26","sha512":"3f0439fa3817c71a6b34673cd32707137b29823e93b8389e1deff24e46c427e5396a897b753ba98bfe156f01c7ce54155bbed56f418b388b22622807802e6f72","ssdeep":"1536:1UXY7qLtpHt2Pqe1mZ8I6H82RaLiMBlo2VV2B/S/g:MYeJpN2yefjMBlPV00/g","tlshash":"529308dc7299b07157eb31f1107f140bf2365a19ac0ec194b222e4e67cb984d92abe7d","size":93675,"data":"","first_seen":"2023-03-07T01:18:07Z","last_seen":"2026-08-06T08:57:33.068236Z","times_seen":4442,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"7e4f6609f886242603c2255d0def985b","sha1":"407202ff2aad2eff76e6acb10bd65de62d8e8c15","sha256":"f01d330916637b0f11677cdfa6a24987d4b510a3573aa496f289231d4ef6178f","sha512":"99465767f18d2c4d58a06ceff578bba60969e22aaf5f89e68381fbdaa8d83029572cd2ec198a9cf49b62618473079670e38a656dd529ed928f262450e4b24c02","ssdeep":"","tlshash":"4311bd2ac5874d2b546624596b9eb00430b601078e09f416ba5ecb8d1f1de2f41f6aed","size":871,"data":"","first_seen":"2025-10-18T16:01:39.9065Z","last_seen":"2025-10-18T16:01:39.9065Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/CZCERS.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.938Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/CZCERS.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:52 GMT\r\nContent-Type: image/png\r\nContent-Length: 139424\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B441CA94393489D5A1\r\nAccept-Ranges: bytes\r\nETag: \"478A2979088A4EBAFB70756EA0316DE5\"\r\nLast-Modified: Fri, 19 Sep 2025 15:38:46 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 15974296255722765269\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: R4opeQiKTrr7cHVuoDFt5Q==\r\nx-oss-server-time: 27\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":139424,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 644 x 650, 8-bit/color RGBA, non-interlaced","md5":"478a2979088a4ebafb70756ea0316de5","sha1":"628300710ec0c8e1621e6b566be2fd4bbd5ae17d","sha256":"1c052254105db55eebb725f8bdb2c6a9400c6f7b9eb866cd843b81defd4f6d9a","sha512":"95e5ad286f27acc1b82bf61065fb541c2c69cba031de45bef7169e890fd8147dd394597d220518b01fae06f4937cd42eb71ea9ff1bc5933b77c003dceb91a708","ssdeep":"3072:Q5mieiGe2XgM9xQhYKwfVG2Avb7ySyJ7FLn2SB5G2J1ES:8AneY9xQCKwfVb8CJ7FLn2GG+ES","tlshash":"9fd312933f0026906cfad87827bfb0e26c973d44662a52d90eddda58dd307b9cd548b2","first_seen":"2025-10-18T16:01:39.240387Z","last_seen":"2025-10-18T16:01:39.240387Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1238,"timings":{"blocked":-1,"dns":0,"connect":175,"send":0,"wait":206,"receive":368,"ssl":489},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/notice/list?key=ROLL_NOTICE","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.612Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/notice/list?key=ROLL_NOTICE HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=nymexpa","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=nymexpa HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/gmx.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/gmx.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1356\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XVgIFOYjkMDkVu5cJtmzXlpkqCV4SxK5plxdEknUt9%2F4SZYMf2YTTGn9UIoXOq%2F0Fp1FC6D%2BbmAQ4OMIMkZrIc4YTDZvwGN%2FuuSAAw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940442f10783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cf2rBBidfkUNAM1YF3pqq_ztnkiVCC1sJpdwOrFCe5DQ:fcda8fb6203f94fd6ad631627311f5cf\"\r\nlast-modified: Wed, 02 Oct 2024 09:30:57 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=16+9 c=0+8 v=2025.10.8 l=1356 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1356,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"1b80eab9bca2adbc3138a665356c3a39","sha1":"c8fb315416ac6d16f28e07371e626c085c80247b","sha256":"5dc748f77113c1a245a995b25bd47bfa5706f4a955fb784357df44c645e0639a","sha512":"5b9c85a88d8159a1619a6cf4f708082a1077a3b0b0812caca3035596531481dca5332c8853d13235d5f77d13b9a7f4bf4b3c0063b93f925450ab2d6675c29e1d","ssdeep":"","tlshash":"d221725917e81c32e08c837504dd43262609bba83beb5abba48a3284d460763efe5d1d","first_seen":"2025-10-18T16:01:39.253262Z","last_seen":"2025-10-18T16:01:39.253262Z","times_seen":1,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=webp/logo/1/tron.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.118Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=webp/logo/1/tron.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2732\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2swbdVcNRNkwMQz0cVNSyojAltHXVx2KUNkjz5A4u5QgBBCIpIenWYkaYuAkY7lZiZudfMmwbKSFIfNyzxTH3lYAOcLuWlxKfcWADQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940449856783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfQUutlkwJIsL5SwktmmvTPCXJUIOyKwvJ4Ys7e8c_DQ:5e583b281bce64da4a63e01dd20ebed2\"\r\nlast-modified: Wed, 02 Oct 2024 14:42:10 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=39+3 c=0+2 v=2025.10.8 l=2732 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2732,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0a35451542ae61be7e9e9b9fcd921928","sha1":"809cba7ecb620271612acbf0b4e831b516015aa4","sha256":"2e758e20250e12f8257d9382fe2a436939a755d4d01699867c06d06fdcd69b17","sha512":"55aa3d0a74548236fc6cbe9d247384d57c377dc421b436586b223012102de40182eae95e492b97fb8c1ccb058f32d1b88af547b2c3fc8d1f7535b4b0fa74cb96","ssdeep":"","tlshash":"53515ca8c8fe11aead9fe74d33b2c6a2e847f0ac09700ca54407817c49e5b3f1db5665","first_seen":"2025-10-11T06:36:30.337551Z","last_seen":"2025-11-15T10:35:16.196947Z","times_seen":3,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/element-ui/2.15.6/theme-chalk/fonts/element-icons.woff","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.584Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/element-ui/2.15.6/theme-chalk/fonts/element-icons.woff HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/cdn/element-ui/2.15.6/theme-chalk/index.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-type: font/woff\r\ncontent-length: 28200\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\netag: \"68a73026-6e28\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28200,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 28200, version 1.0","md5":"535877f50039c0cb49a6196a5b7517cd","sha1":"0000c4e27d38f9f8bbe4e58b5ce2477e589507a7","sha256":"ab40a58972be2ceab32e7e35dab3131b959aae63835d7bda1a79ae51f9a73c17","sha512":"da269b20f13fb5b0bb4628b75ec29e69bb2d36999e94b61a846cb58db679287a13d0aa38cdf64b2893558d183c4cc5df8da770e5a5b2a3288622cd4bd0e1c87b","ssdeep":"768:gOvv6ExpCVxUtrT6w8ClFd80EjPVerMKBaGXjAlEm:Hvv6xVWewtlFdGjPlkFjAlEm","tlshash":"b9c2e13197213ae9d9824ef876e498fef1651402290f390e8696adb3a98d5c73e16831","first_seen":"2023-04-05T15:22:49Z","last_seen":"2026-08-06T06:48:56.49647Z","times_seen":29339,"resource_available":false,"data":null}},"time_used":1176,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1164,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeca","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmeca HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xagusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.345Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xagusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3366cd00a7c3e93f51a88e13253d4d5d","sha1":"1ebddb2d49dd1d2d95ce75e18210b25229e73346","sha256":"0f5cafd3bcc6a04fe8d1e7f4e89ff5843601af65b79adb13039a3bf111b2acb1","sha512":"2b1f3fa6011982a1dbac1790c0b105a5d4b65ea1537244e0b3fd353d1a854f552003993b51b0e6bd6f353b0906da8e68c129ba2d708292d9c767b6dc33a29e67","ssdeep":"","tlshash":"8c9002555c5d8242e8d300a5a61a260400243160262493484d59512584c82a22044858","first_seen":"2025-10-18T16:01:39.269397Z","last_seen":"2025-10-18T16:01:39.269397Z","times_seen":1,"resource_available":false,"data":null}},"time_used":415,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":415,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getAllSetting","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.425Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getAllSetting HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15015,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (14633), with no line terminators","md5":"a8cadfef78f80dea1980fdae1344cb74","sha1":"72c9016f156fdf7995eb7e5288002fadb282bfaa","sha256":"2712a2443fc17ff76a5febfb83b40e55e60b6dba5b7d01919a099b8810a78549","sha512":"05a25863713182208fdbb1143e445e6203121c31735a03b5529d8d301c82c1810a9a919e873a26ed6fc0c4a459622bbf4cb89c4634070364cb736a87109c7b89","ssdeep":"192:N0mlPfrd3rdzFFgljWPB6TyD+uJI+Rbuc2wJHGHiiiLLH3AvJoAU5bOGKz32se+Q:Ky3hpWlHUAT2CGMTLNBt/hifRf+o","tlshash":"b062861937d4ccbd56e71ed654bb2a56bbcc3477d198dc09e5e6ae0c888cab3480f10a","first_seen":"2025-10-18T16:01:39.273156Z","last_seen":"2025-10-18T16:01:39.273156Z","times_seen":1,"resource_available":false,"data":null}},"time_used":214,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":214,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=usoj","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.751Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=usoj HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":380,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":380,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uskc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.146Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uskc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"393b3dc54e63b3fc0ba0427773fde97c","sha1":"1dac880936b505275cbaab2fe504566d71cca73d","sha256":"52ebdb177a01e972b502ba43bb337e6796a06b44f4cb1f12257d43fdfb5d9dc3","sha512":"67032e19ad37bd0e8a77716c6a3e04969a4a8bd141c0ce1288b2e8a08eaec48ea2a0b202dc338f971d8e7e069d437a009127a0f69e64c02ef46a1aa3489a2e64","ssdeep":"","tlshash":"8c9002555c1d8242a88340a5990a160804343271262493485c59923594982a26044898","first_seen":"2025-10-18T16:01:39.280278Z","last_seen":"2025-10-18T16:01:39.280278Z","times_seen":1,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszs","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uszs HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"06e35ea270386136bd1f642fff6b3672","sha1":"4f3d9e9aa06aa98cd380201b2efbe0dea17cb87b","sha256":"2c74b8d580f9214a73bb26284f47f959d747d4687df1096ba2e95acc790ab91d","sha512":"3eb955c3e8b3ba6b245261e798b5b4bfb2665170dd68cb2d5308ed9317321a3b17b58d2bd45624af09f9fe43def7611786ce85119b9a43863c4e58674bbf635b","ssdeep":"","tlshash":"979002556d2c9252a88300a5954a1604002431657664a3584c69552580881a22048858","first_seen":"2025-10-18T16:01:39.284604Z","last_seen":"2025-10-18T16:01:39.284604Z","times_seen":1,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"echo-pro.oss-cn-hongkong.aliyuncs.com/echo2.02478cabf90c24e8e9f86516433c92864.png","fqdn":"echo-pro.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.02478cabf90c24e8e9f86516433c92864.png HTTP/1.1\r\nHost: echo-pro.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 408\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5AFAD5B3438A7085B\r\nx-oss-server-time: 1\r\nx-oss-ec: 0026-00000001\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1135,"timings":{"blocked":-1,"dns":22,"connect":272,"send":0,"wait":270,"receive":0,"ssl":569},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/svg/loading-spin.svg","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /svg/loading-spin.svg HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 422\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\netag: \"68a73026-1a6\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":422,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"037f0a4f642ab8e77b624c3397411ebb","sha1":"32472bcb995af56caeecb9dd747bd56545fa0b8a","sha256":"8af421d321398026263f9eeb85acf0130787e4d66ee173dd2023d291b021d59f","sha512":"fc66e5c04f76fd183f2e64aa86ea80c93d24805219d3ac5b59968a535b27a4631905f389d02d93979bd1e941b81ca683040926d6257ef584ed341ce216ccdc6e","ssdeep":"","tlshash":"00e02bb9ec1e660f402e479b6aacd800239dd2f127050096e72c1c39680f419eae7149","first_seen":"2023-08-28T22:21:58Z","last_seen":"2026-07-30T19:42:39.843951Z","times_seen":318,"resource_available":false,"data":null}},"time_used":1235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":616,"receive":619,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/fonts/DINOT-Regular.d5ae250f.ttf","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.737Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /fonts/DINOT-Regular.d5ae250f.ttf HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/css/app.0b04c088.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 12381068\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\netag: \"68a73026-bceb8c\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12381068,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, digitally signed, 16 tables, 1st \"BASE\", name offset 0xa88e6c","md5":"8c1c07fe2997321d54b049da39e880fa","sha1":"e85c69e54574d47b1a3b665a5f7c98ffeafcd371","sha256":"c6b6dd24e24ea6c07767f20fc1b2dfe86f31b1ca166ae620079c67dcdd5add6d","sha512":"192427288363eb352a702f85cbf2d714a78374d4583da9be541fdbcbbaf4e643103ded1b942d601838476029b05eb5b84d8b08998b546046255fa29670bf1127","ssdeep":"24576:H/8MftuDPIz9ZeJ199QETruMGR7JrhCannDH3l8cVZYIVY0:EituDduVjn7Zf","tlshash":"94257bc297c92d1eea22bd3c2440f63e70ce65088a56d6fade431f3718429741de9eb5","first_seen":"2025-07-29T21:26:30.315596Z","last_seen":"2026-07-28T19:29:08.845288Z","times_seen":86,"resource_available":false,"data":null}},"time_used":6533,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":587,"receive":5946,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.154Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uszc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"986b24f3f5790c431cdaf171ede02374","sha1":"1bf2d1d1a8695d50776b0c219a38fb0669540adc","sha256":"fa1d10b9ae01d0832169e79a9710049a99b4e48f7cc76a72a1172fdf0374833a","sha512":"9ed225fe5aa661f61a344afad4fa6e950d1ec14d2f63126c49ed1b5a4386f9b2a3d92c9140fa8f57a81be9be81a89dd09c70ee88dae57b1e25e24dee9db147de","ssdeep":"","tlshash":"599002555c1c8242a89300a5950a160400243260262493484c59512680881a2204485a","first_seen":"2025-10-18T16:01:39.297565Z","last_seen":"2025-10-18T16:01:39.297565Z","times_seen":1,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/chainlink.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.870Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/chainlink.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1697\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2F58%2BrC8jo1TPNUZV8OdOz7MJPCW29sp2h%2BzgNBWX2bNd93BBW%2FBwkSv8SVbBUahUIivyHntr0ADTczStbjwOdOHm%2BSS5AYqoL31l7w%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940440e8d783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfad13RldMkl-b3UnNfi0TRyiqiVCC1sJpdwOrFCe5DQ:2706d4cbacb414f5fe6d69f9d17c63b2\"\r\nlast-modified: Wed, 02 Oct 2024 07:21:32 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=46+8 c=0+8 v=2025.10.9 l=1697 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1697,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"83d515a4306ff9e007d9c08378ca4e23","sha1":"8fbce28c04e1e2e02e4b9105f2fede371b42ca24","sha256":"ae7adc249d17c2ee006dec2d90cc30f477450cd80385314447c447bfe7681ca4","sha512":"b8dc0f1cbb56bb244d6aea04c087dbb07852b288801215c903bd2149de8483ef8b15a5ef26271249de139900e132bf087db61bcbf4278644aff61e421467526b","ssdeep":"","tlshash":"6c310a19b7c50902eca85239849dd23911d0a3bfa6d3d90358c2724491b033fff3ce59","first_seen":"2025-10-18T16:01:39.302252Z","last_seen":"2025-10-18T16:01:39.302252Z","times_seen":1,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/safepal.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.908Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/safepal.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1291\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cIqJPCQYY%2FqGCzseiwTFNd%2FQ%2Ft8nv%2Fz8E%2FW9fc5XD4r9DFNmsWx%2FQCpkQY%2BVLqZJtlFNbN2VixlqZu0lZMkPb2YtlTimn%2ByCMvbLOg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940442f1a783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfXA9Iod71H2qFzl2V9ZCeKu14iVCC1sJpdwOrFCe5DQ:20077032304296bf9215513c915e048e\"\r\nlast-modified: Wed, 02 Oct 2024 13:17:20 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=18+9 c=0+8 v=2025.10.9 l=1291 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1291,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"9b09b7bad88fa165c742d1f98460b267","sha1":"0dd83d588fa8ca1f6ec126990a829dd7bfb32095","sha256":"7a24ab66ae6f6d34ce27dcb57fca4a83eb31d4ce6ff47d52531867928ce33a21","sha512":"55309cd9a194f726baf0a9ebc553e69393f2baa80c2d69cf5230cb978d66a60e49a6e7ca80da1e7f25dd8e9aebf9a3ca01eeb105a910bfd1682625627c764874","ssdeep":"","tlshash":"9721875ad3e99d42dcd54339098d139413b0913d5797cee21a5171488831b2bdd58d34","first_seen":"2025-10-18T16:01:39.30685Z","last_seen":"2025-10-18T16:01:39.30685Z","times_seen":1,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":139,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/f/f0/NatCopper.jpg/250px-NatCopper.jpg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.930Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 Aug 2025 07:58:25 GMT","end":"Fri, 14 Nov 2025 07:58:24 GMT"},"fingerprint":{"sha1":"00:6B:23:79:C6:3F:3F:33:1C:96:A8:58:E3:42:75:58:02:2B:84:D3","sha256":"AC:53:65:9E:C2:DF:AA:6F:9B:55:55:44:CF:4E:94:5A:41:C1:12:6D:4F:EA:F3:3D:EB:5E:40:17:00:3A:2E:26"}}},"request":{"raw":"GET /wikipedia/commons/thumb/f/f0/NatCopper.jpg/250px-NatCopper.jpg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 10:35:46 GMT\r\netag: 32a4b512971e1cbb48e3c81a5dfbd611\r\nserver: ATS/9.2.11\r\ncontent-type: image/jpeg\r\nlast-modified: Sat, 19 Aug 2017 05:15:12 GMT\r\ncontent-length: 21498\r\nage: 19505\r\naccept-ranges: bytes\r\nx-cache: cp3076 miss, cp3076 hit/13\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=6orIHzOE6YkW9cebP4vU7QKQAAAAAFvdW3YV59xYsvT7wkbLBT-Hu6SioqqUdL6A;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 18 Oct 2026 00:00:00 GMT\r\nx-analytics: \r\nx-request-id: 2296105d-31b1-4e5f-959a-c1036e92fbb8\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":21498,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 250x236, components 3","md5":"32a4b512971e1cbb48e3c81a5dfbd611","sha1":"4f1ca97485b4bc4debb1517c6abb3da2ee777da5","sha256":"263cbc0bcb2e49228f73d6a0276cf1dc43f8554d0840ab9bfc37104e8555c795","sha512":"62214ee4aba8f077435e15063eaca6a9f9a95bcb641fbb6df95f64fe198d843fbb33245c604e222e09c362a7b076fc4c9a12e340394ba1d995e6d2c274aed140","ssdeep":"384:ZJiwFja2Gd+8P+uSQJqMooKNbnK/tNQP/Yebc70itzlP2+TL7FN67HDXVq:Diaavd+5vQJ9oowyQ1EtzlO+X7FNerU","tlshash":"68a2d070f77a1cd6c8cc4ba2e2ec862be301f537f6eac7045f844d09146515868e97aa","first_seen":"2025-10-18T16:01:39.311692Z","last_seen":"2025-10-18T16:01:39.311692Z","times_seen":1,"resource_available":false,"data":null}},"time_used":118,"timings":{"blocked":-1,"dns":1,"connect":24,"send":0,"wait":48,"receive":3,"ssl":41},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"media.nownews.com/nn_media/thumbnail/2019/06/brown-216001_960_720-768x548.jpg","fqdn":"media.nownews.com","domain":"nownews.com","tld":"com"},"ip":{"addr":"54.240.174.111","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.934Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.nownews.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 18 Oct 2025 02:02:30 GMT","end":"Fri, 16 Jan 2026 02:02:29 GMT"},"fingerprint":{"sha1":"1F:00:43:21:A2:5C:20:64:DE:3D:8A:3F:05:44:DF:46:BA:D0:3B:94","sha256":"34:D1:1C:46:A7:2C:47:82:E6:89:FF:D2:AD:47:0F:7E:DF:E2:26:62:FA:63:05:99:11:FE:94:7B:50:D5:D4:B3"}}},"request":{"raw":"GET /nn_media/thumbnail/2019/06/brown-216001_960_720-768x548.jpg HTTP/1.1\r\nHost: media.nownews.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\ncontent-length: 86371\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\naccept-ranges: bytes\r\ncache-control: Public\r\nx-goog-generation: 1639552878533676\r\nx-goog-metageneration: 1\r\nx-goog-stored-content-encoding: identity\r\nx-goog-stored-content-length: 86371\r\nx-goog-hash: crc32c=vnigIQ==, md5=oV2kC1jBxKzwcs7ASOh40g==\r\nx-goog-storage-class: STANDARD\r\nx-guploader-uploadid: AAwnv3IrK0j_jri9tNy6_YQXZcxhT-t0QbIAjlacIMI-VDxZNDXCT5f4aVVwtjOcBm_W3v5P\r\nexpires: Sat, 18 Oct 2025 16:55:18 GMT\r\nlast-modified: Wed, 15 Dec 2021 07:21:18 GMT\r\ntiming-allow-origin: *\r\nvia: mly inter, 1.1 9037b7743a833da13439f0d4e2619b52.cloudfront.net (CloudFront)\r\nx-mly-id: ae5dfb1d5aae76686c5d45dd6b4d63e4\r\netag: \"a15da40b58c1c4acf072cec048e878d2\"\r\nx-cache: Miss from cloudfront\r\nx-amz-cf-pop: OSL50-P1\r\nx-amz-cf-id: SR2fz3EjcUkSs16hAccQStvw5e_JFmbL9SZnJV91MU-AHhH1UicmTQ==\r\nage: 334\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Google Cloud Storage","description":"Google Cloud Storage allows world-wide storage and retrieval of any amount of data at any time.","website":"https://cloud.google.com/storage","common_platform_enumeration":"","icon":"google-cloud-storage.svg","categories":["Miscellaneous"]},{"name":"Google Cloud","description":"Google Cloud is a suite of cloud computing services.","website":"https://cloud.google.com","common_platform_enumeration":"cpe:2.3:a:google:cloud_platform:*:*:*:*:*:*:*:*","icon":"Google Cloud.svg","categories":["IaaS"]}],"data":{"size":86371,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: \"CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82\", baseline, precision 8, 768x548, components 3","md5":"a15da40b58c1c4acf072cec048e878d2","sha1":"48ced9c4d93338aaf9f4eb7dde42a7e87adaa134","sha256":"fa1d216b96cb6d68a158ca56ccb29d5f52c6501b2623ff87ef86e5604756d2e7","sha512":"17bcef7e4ba689a9cc8e946ab4a36e3ff5564b01c9555e46870a793a394bbd6dc0ab88ba55faf2572ed7f8bca8b93859b09904eaa4cde05600d3562445aa7ba7","ssdeep":"1536:oG0HKwGHXUn6joNlNpLi+4dM8fqBLCYOQHhcNA79Cy+797ftWSMX9zKp:HwGHXJ4LB4O8fEBOQHhcNAJCyeaX9y","tlshash":"db8312ea75a307c0589e6af5239554897631d10e6f852045fceac8bdf453bcc0e33ab9","first_seen":"2025-10-18T16:01:39.316761Z","last_seen":"2025-10-18T16:01:39.316761Z","times_seen":1,"resource_available":false,"data":null}},"time_used":939,"timings":{"blocked":-1,"dns":67,"connect":1,"send":0,"wait":582,"receive":279,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/4/48/Tin_drop.jpg/250px-Tin_drop.jpg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.095Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 Aug 2025 07:58:25 GMT","end":"Fri, 14 Nov 2025 07:58:24 GMT"},"fingerprint":{"sha1":"00:6B:23:79:C6:3F:3F:33:1C:96:A8:58:E3:42:75:58:02:2B:84:D3","sha256":"AC:53:65:9E:C2:DF:AA:6F:9B:55:55:44:CF:4E:94:5A:41:C1:12:6D:4F:EA:F3:3D:EB:5E:40:17:00:3A:2E:26"}}},"request":{"raw":"GET /wikipedia/commons/thumb/4/48/Tin_drop.jpg/250px-Tin_drop.jpg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\ncontent-disposition: inline;filename*=UTF-8''Tin_drop.jpg\r\nlast-modified: Tue, 08 Apr 2025 11:55:40 GMT\r\ncontent-length: 12813\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\nserver: envoy\r\netag: 401805c6406055d861a6af52320cfbd2\r\nage: 1\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 miss\r\nx-cache-status: hit-local\r\nserver-timing: cache;desc=\"hit-local\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=Y0jv8ATpEz_xoYh6w6vliAKQAAAAAFvdb7UIoHRN88j45lYY98Q_zCsRELQp-FvF;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 18 Oct 2026 00:00:00 GMT\r\nx-analytics: \r\nx-request-id: fcad75ba-8b63-4523-8905-63330cfadf18\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/iconfont/avue/iconfont.css","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/iconfont/avue/iconfont.css HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: text/html\r\ncontent-length: 138\r\netag: \"68ba980f-8a\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-08-06T11:17:02.632525Z","times_seen":316809,"resource_available":true,"data":null}},"time_used":415,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":415,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xauusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.717Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xauusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=cmefc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.748Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=cmefc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":384,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":384,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xpdusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xpdusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"899ad79c720864e2b4b4c07704354b72","sha1":"cb68fff8704e9a9c71594c9458facff06cdea381","sha256":"e18b594eb1c4709be2b375dca87e19961862d1d28218510471d285266be617ee","sha512":"c1631743234ff6769ab684d155421ea29f959122c4470704052d1acfb8363824d0c27e3bb727c3080e4ae6e23dbed189265f305230c84eaa2d3c24fb1e338015","ssdeep":"","tlshash":"119002555c1c8252a88700e5950a160800253161262493485c59513580882a32044858","first_seen":"2025-10-18T16:01:39.33252Z","last_seen":"2025-10-18T16:01:39.33252Z","times_seen":1,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/metal.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.888Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/metal.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1095\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4MHgxscUR1WHyGFA5neQo4TzP1Yv210r72Sy3nnK%2FcVI2BrlnHnAJBjUCa81HIG68ba8zfrlBUcnwQqsYbUs1EBLqTU6f%2FLIjk9PoQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940440eb5783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfsuc7ZJA-sU7uFGd03aiP-n55iVCC1sJpdwOrFCe5DQ:8b36ee5cf18dd0db014c064a6ee7b16b\"\r\nlast-modified: Wed, 02 Oct 2024 11:17:04 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=25+8 c=0+7 v=2025.10.7 l=1095 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1095,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"e8f2b9519f3396c98aa0ff4053c5e406","sha1":"4f3155057e57ee53da217b9581443dc866b84e65","sha256":"9dd2a62304fcf42fa84a4efe7c1834b2d1149fee38fbcfb69b37561a554199fb","sha512":"56483141ff2557a5156dc12dd2426bdb7614790e68629d1ffdf2c5dbe0b37becfacb25a5640e80bf0e7e10d3c9803b6b6e28058b76ab412b45b11011c97fbe60","ssdeep":"","tlshash":"3e11a52a5a400e22fdad02f1249d03262160e278027f28fba8123e42c931bdfce15c38","first_seen":"2025-10-18T16:01:39.337484Z","last_seen":"2025-10-18T16:01:39.337484Z","times_seen":1,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/AUDNZD.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.096Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/AUDNZD.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 270715\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B59D920A3036081CA1\r\nAccept-Ranges: bytes\r\nETag: \"544CDE56D13E65CCC3449044CCAE76C8\"\r\nLast-Modified: Fri, 19 Sep 2025 01:08:41 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 3775915679684845099\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: VEzeVtE+ZczDRJBEzK52yA==\r\nx-oss-server-time: 23\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":270715,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 710 x 732, 8-bit/color RGBA, non-interlaced","md5":"544cde56d13e65ccc3449044ccae76c8","sha1":"57c38fb27929e69e6d29d501206386521808d9b4","sha256":"b5a9d59e020a478268f760d9668bf1c9a9d09960f329178888c7b7ffa7a3e772","sha512":"f798f7523735b42b09cc1e0e7c4eaf2f2a64e2244a788316056611e6a82bcd23ca8a8ad0031f8e964d29b81b2c7873264c17bf949f70d13ced2f35e1e0b7beef","ssdeep":"6144:+LMWl6d9tEJjFZtukChi8uXkn22abspaWI5Xse9kd0A3C3Xc7NC:6Y9cjFLu5i8uXb2aGaWI5cB3C3uNC","tlshash":"fe44232c61ecd4edfa360a135aa5c8d8e388ab9f0c1217dfba0db48bc5e7a75d51c054","first_seen":"2025-10-18T16:01:39.342189Z","last_seen":"2025-10-18T16:01:39.342189Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1887,"timings":{"blocked":1591,"dns":0,"connect":0,"send":0,"wait":207,"receive":89,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-res.oss-cn-hongkong.aliyuncs.com/echo2.09d81740435c046b887686bfce921ec53.png","fqdn":"echo-res.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.571Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.09d81740435c046b887686bfce921ec53.png HTTP/1.1\r\nHost: echo-res.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 333\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5794D1037316CE1FE\r\nx-oss-ec: 0003-00000905\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1967,"timings":{"blocked":832,"dns":25,"connect":269,"send":0,"wait":270,"receive":0,"ssl":555},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-res.oss-cn-hongkong.aliyuncs.com/echo2.0a119950ef2af4521b3a3943cfc49de98.png","fqdn":"echo-res.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.576Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.0a119950ef2af4521b3a3943cfc49de98.png HTTP/1.1\r\nHost: echo-res.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 333\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5CE63A83631102C0A\r\nx-oss-ec: 0003-00000905\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1213,"timings":{"blocked":-1,"dns":22,"connect":294,"send":0,"wait":292,"receive":0,"ssl":605},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/GBPUSD.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/GBPUSD.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 310772\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B541CA9439348DD7A1\r\nAccept-Ranges: bytes\r\nETag: \"F3EEF94C5C7BF2516AC23C03584FD1E9\"\r\nLast-Modified: Fri, 19 Sep 2025 00:45:04 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 11712700101510716451\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: 8+75TFx78lFqwjwDWE/R6Q==\r\nx-oss-server-time: 28\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":310772,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 629 x 618, 8-bit/color RGBA, non-interlaced","md5":"f3eef94c5c7bf2516ac23c03584fd1e9","sha1":"bf1355a4635dd1cbb758422b09a4b105f9442bfb","sha256":"094be7f8ba26277b2f08e8a1e022077aa85ff838d95865648da1314cd7e3ad99","sha512":"3edd00b4f6d7320194e81fccd6cc99bd0420e674db3ccb5194e0acfceb4bd363dd9f2f33689c954d92ac4acd9dfdd70c6e0c4d56863028b489d97af4d0dbd5f4","ssdeep":"6144:Zkj00loaIqo72isrBF12EhtU+XRVh443cnr5zIjuux:gSa8721tQARV4rmjuux","tlshash":"be642346b9e00e7ae459e339e57cdba32ecf2566c934d0180c08473e9255133bdcb6aa","first_seen":"2025-10-18T16:01:39.347063Z","last_seen":"2025-10-18T16:01:39.347063Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1636,"timings":{"blocked":1188,"dns":0,"connect":0,"send":0,"wait":234,"receive":214,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmepb","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmepb HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeah","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.742Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmeah HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getCoinList","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.611Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getCoinList HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xptusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.589Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xptusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeni","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.608Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmeni HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":391,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":391,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=dcec","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.392Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=dcec HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b56a1635a393197e6de45700f20a6912","sha1":"9433b47f6a74e74a404d005ed6f9520f4843cb59","sha256":"9055df1e7c6298626914d212625b1a6373e01c28389490e917b0f51899a2462c","sha512":"82707cb7b50913cb307c931b46f3b48b4ed4bde63533d5e6906c288bb67fc3fa94dbd11ec64168eb07282e117a753647b8663a2eac39dd76098d7d1f216e06c2","ssdeep":"","tlshash":"139002565d1c8242ac8311a5951a161400343170262493484c5a512584981a32048858","first_seen":"2025-10-18T16:01:39.358482Z","last_seen":"2025-10-18T16:01:39.358482Z","times_seen":1,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":300,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/avue/2.9.5/index.css","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.095Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/avue/2.9.5/index.css HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-153f9\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87033,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"f85e11dcb08e7df97a595b462fc1e5fd","sha1":"4a21a20075980f155f0880ff27c3681413bf91a4","sha256":"0d6f8a0ccc1a2588ea5b922811dc52facc493898321a9ab48f9d4f469db5ccab","sha512":"5a944b594ffb9ac17ab736c56f04c12db40e3371b5fb01da19ab6bb421eeb12788161552a5281c4e1e3e5e523de204a9d4bd8c0ca9b3295bdae4a4875f4a5a7f","ssdeep":"1536:3ZpTJrrdtEOddi1H0jsamI897x9RUEAhgFRJgQwwCvpyR0ol1vk27rnIRf:JpTJrPEOdddAamr97x9RUEAhgFRJgQwN","tlshash":"918340625e7b0c09e80add542bd8177d37282053880ad9fb7ef931484f8679d47a2f8d","first_seen":"2025-07-19T06:38:51.487767Z","last_seen":"2026-07-28T19:29:08.84895Z","times_seen":60,"resource_available":false,"data":null}},"time_used":415,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":415,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/vuex/3.1.1/vuex.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/vuex/3.1.1/vuex.min.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-2d85\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11653,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (11593)","md5":"ccce53cbb3813a63f1420eba489574af","sha1":"94ac9c787b2b96236356286c44350260c9f08a33","sha256":"1610512a47faf745fe96ac631be8ea3ea50a222fe7d7cca691f7ff8194b934bc","sha512":"78a2cf9dd160d4a451c1536de4d0037330d8ed11d07f0edaa427de7131a190af3c86d1a3f5bd858cac14f16ca70f78b2dc4bbe0124f7d3a2a4cce8872b95b8bd","ssdeep":"192:ViDaQv4w9nWp4UvouC3Dqs/778IG0zqLVFcu8XCnrdVpVAQflmGcXg3H8VnbZqlp:VeJgqnWp4kYj78p16CrdKMQ0CbMB+a4+","tlshash":"6a32cb9a73e1762aca57b0b0ac5f9c08f275a9dc1686400c6a4dc0f99c754bccb7ed9c","first_seen":"2023-08-28T22:21:58Z","last_seen":"2026-07-30T19:42:39.876395Z","times_seen":282,"resource_available":true,"data":null}},"time_used":615,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":615,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xagusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.729Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xagusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=usoj","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.145Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=usoj HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5a60f2ebf0437d875e47fe5afb8a403a","sha1":"9582e16cda7fa5b4f0709115f74141854218c4cb","sha256":"789ddd5fb8a787b53c0a1f813dc6ff6403843eb1d4d0faabb164314b40ee028b","sha512":"645b5d72fe48d0476eb3cb75dd8ed8d4e56db1afc9530a0cd7791b897d8bf2de0ed21f9755157e8bcf8b7d943a90c17c60960c1f7a955e66faec25b18641cf96","ssdeep":"","tlshash":"fc9002565c1c8242a88300a9e54a2204102431702aa492888c595125c0c91a62044898","first_seen":"2025-10-18T16:01:39.374393Z","last_seen":"2025-10-18T16:01:39.374393Z","times_seen":1,"resource_available":false,"data":null}},"time_used":213,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":213,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/polkadot100.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/polkadot100.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1037\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ez3NoEBhMCTYlSLMa6lwpeMwU2Y2wAuFO6645ngdoIL6pobwMYnwa0BVROyJP2Ddb4yO96ZClVgLLCs0Ny5eW4DUqzOFVCQdAv%2BwKQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940441edb783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfJWIbMsCC4juKXNf5AXm27dvtiVCC1sJpdwOrFCe5DQ:133ab2220e0eadcff09b0a83add7ea94\"\r\nlast-modified: Wed, 02 Oct 2024 12:38:50 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=13+12 c=0+11 v=2025.10.7 l=1037 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1037,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"f6a43f35b6bc70428ec338fda91b0045","sha1":"12ed63f07866c07203e1656d567832630c54844e","sha256":"5c7952ec4f0ba6381a80a2d37de2433dba05e01dffc36afa9800691a61695ece","sha512":"0ad75b31db2959b46b7a084a69c2858909446411dd2c9c00418fc3bc3cb19e36651c19d887c510faaa8ac0f20f5c59aa7b0f2f404e90eb12fbdef781e8653346","ssdeep":"","tlshash":"4e1194a777950c15ec3b07341d0919ca6415fd6b9a710a15f3c672b68c175a2cc75e90","first_seen":"2025-10-18T16:01:39.379603Z","last_seen":"2025-10-18T16:01:39.379603Z","times_seen":1,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":96,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/5/57/Nickel_chunk.jpg/250px-Nickel_chunk.jpg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.943Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 Aug 2025 07:58:25 GMT","end":"Fri, 14 Nov 2025 07:58:24 GMT"},"fingerprint":{"sha1":"00:6B:23:79:C6:3F:3F:33:1C:96:A8:58:E3:42:75:58:02:2B:84:D3","sha256":"AC:53:65:9E:C2:DF:AA:6F:9B:55:55:44:CF:4E:94:5A:41:C1:12:6D:4F:EA:F3:3D:EB:5E:40:17:00:3A:2E:26"}}},"request":{"raw":"GET /wikipedia/commons/thumb/5/57/Nickel_chunk.jpg/250px-Nickel_chunk.jpg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\nx-object-meta-sha1base36: rwz579jx3bn9x6ktdu0ujmm4qogeer6\r\netag: 766ef0f19e3dc4666d9a2c9ac8ff50e1\r\nlast-modified: Tue, 29 Oct 2013 18:14:23 GMT\r\ncontent-length: 15937\r\ndate: Fri, 17 Oct 2025 17:42:08 GMT\r\nserver: envoy\r\nage: 80324\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 hit/5\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=chKyksIHDLAxCWiWs_w_NAKQAAAAAFvd2dJiudLnLEDgv9SH60P-e0q7T3VN9sHi;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 18 Oct 2026 00:00:00 GMT\r\nx-analytics: \r\nx-request-id: 06ffef54-4883-4171-ac79-97122e79c576\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15937,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 250x263, components 3","md5":"766ef0f19e3dc4666d9a2c9ac8ff50e1","sha1":"eefbecc18bfb7a4701e99ae95ca8e9ceb1625232","sha256":"2cae155091208ca3f3c1afda5d16a2b8308e324c8209e8d1f7555b75ef0b8db7","sha512":"f818ac484c189d84f4d4776da6520e6e007aa42de34881e0725664774f0b199052e6faae417814d34b80e860f52a47bde5bf401069a75c5c21ac6c547475fe67","ssdeep":"384:+VsA+EgyL+9PPEjZ5MfuY0DZqLq2bMyxCQGeRfdZLMXGjKYoe:+sEQ93EjiulDZB24yxVGeFdGGTX","tlshash":"5d62d00c3e2491e0ef81ec7b69979144baba46ed4d869d4c44dc698f84f83eebc9c146","first_seen":"2025-10-18T16:01:39.384062Z","last_seen":"2025-10-18T16:01:39.384062Z","times_seen":1,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":4,"dns":0,"connect":0,"send":0,"wait":37,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/GBPJPY.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.057Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/GBPJPY.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 179726\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B541CA94393400D9A1\r\nAccept-Ranges: bytes\r\nETag: \"7E009A46BA4632D51A731EDDEB8DC9B0\"\r\nLast-Modified: Thu, 18 Sep 2025 23:41:08 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 13958796642557252591\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: fgCaRrpGMtUacx7d643JsA==\r\nx-oss-server-time: 19\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":179726,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 469 x 473, 8-bit/color RGBA, non-interlaced","md5":"7e009a46ba4632d51a731eddeb8dc9b0","sha1":"a83eabb29bcc17ea56a85f2bff3bf6ce94815a12","sha256":"3afee907baae5fec9757c0ed542f3460889c6f89c41440fd5414a638a41071f5","sha512":"6130c00c5166687b44d7c61d4a106b7ff333c840af3a8383737b79a4e47a9d4ce79af612e3cdfed4a49efb72452d15f15cffda6ad849c5d32dee56ea8b1ca3e5","ssdeep":"3072:OUe6fPLn2wiREI1aJvPeU4SN+J/mPEeXu9tkA4NXSO/YaR+rH87bscWEOv41Z6:OUeQL2wiRTaJvmU4SNo/m8eeDdQjR+H9","tlshash":"1504133b82396b2d4e73888ff9189e1bcef2e4ca51b187623c69545cc5a176de01f721","first_seen":"2025-10-18T16:01:39.389952Z","last_seen":"2025-10-18T16:01:39.389952Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1789,"timings":{"blocked":1538,"dns":0,"connect":0,"send":0,"wait":198,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-res.oss-cn-hongkong.aliyuncs.com/echo2.09bc6c590afa84f0780893393bbfe6f8b.png","fqdn":"echo-res.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.572Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.09bc6c590afa84f0780893393bbfe6f8b.png HTTP/1.1\r\nHost: echo-res.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 333\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5EE240037337A0C06\r\nx-oss-ec: 0003-00000905\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1933,"timings":{"blocked":815,"dns":24,"connect":269,"send":0,"wait":271,"receive":0,"ssl":548},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/vue-router/3.0.1/vue-router.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/vue-router/3.0.1/vue-router.min.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-5feb\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24555,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (24485)","md5":"a7656f4be720b1580847f9783d6ab4dd","sha1":"d3582fc6fb317199378638d2a12b4186fdee19eb","sha256":"9d5542c396b2102deb7390b39061aa7ae35f9329dfab9a34823cf84396b8cc13","sha512":"e31c23718a86b6a46355b975f29854ad874351005a9c634a56cfe8f4126198be7d6ca67cd95ba24135ce8cceb3b6dd1b4eaa8f9d4aadfe4061210f4c7b8052b4","ssdeep":"384:Oxwp+JvwAmXRZOYQFoB5RKbKBpZn6ySH1DhUxjImhFVP:Fp+JvwAGjOYQFoB5RK+nnTMa/hXP","tlshash":"b0b2c69db582b03247d326a0816f150bf23b7999744e84a8f2a9f4d43cbd85e8427f7d","first_seen":"2023-08-28T22:21:58Z","last_seen":"2026-07-30T19:42:39.894177Z","times_seen":287,"resource_available":true,"data":null}},"time_used":610,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":610,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getAllSetting","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:45.767Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getAllSetting HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1068,"timings":{"blocked":428,"dns":13,"connect":207,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeni","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.149Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmeni HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"74f3dd79ca6ef171a737b00d5551ce34","sha1":"03fc10abf01b8afbbe08d2345e3bdb599a7dc711","sha256":"f52650fa82cfe8a03079aa446a197d7294b91ff46d319c9b859e0bad03d0016b","sha512":"e64c0a6c1ae874b0a95c1fed71040d053b92f1ff05b4027fc4bd002ca10a47a1e9c3fd2f4f2837b2396e0475129eba73d2a391ad37433741aaab1d40b752e75d","ssdeep":"","tlshash":"3a9002956c5c8247a88300a5951e1604042435a0662493484c595225c0885b22044898","first_seen":"2025-10-18T16:01:39.397755Z","last_seen":"2025-10-18T16:01:39.397755Z","times_seen":1,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/coti.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.900Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/coti.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1402\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=akJs8XjKd%2FypmB%2FknYjrRt3GKpSFZPdo2A7O63tNAEf%2BqawTZOaMbvPwT5%2B2QBBSdLWeHsyeJ3%2B1bRK4SL5UwF18JWGPTuMf7n2Hbg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940441ee9783d-OSL\r\ncf-cache-status: REVALIDATED\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cf2xcL8UgnbumqkKPDwd7dQiUmiVCC1sJpdwOrFCe5DQ:fe5185f3d19fe7825b60dff6acebf8c8\"\r\nlast-modified: Wed, 02 Oct 2024 07:39:37 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=12+7 c=0+6 v=2025.9.5 l=1402 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1402,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"d4d307d4f8a98fb5749103e22f92fc90","sha1":"a9d3bffb2c296939e5fcb1b60e3fb057b63ea3b5","sha256":"07dfe75d173b0d7c00a5f4603f9dae6e1aef8b73fb986d2f5f6e2da17ccb5e8a","sha512":"140c291f3da2bcb2b96060f8f1c4b742f495dc54fa5ea48c12bbd2caa6fb8de691f4ef7e79b1e213a16af29df751655b9f98fb076f87a8629c25f46e9fcd6749","ssdeep":"","tlshash":"7c21784717756c18cc84477509cedb213163ba378baa71a55f267f509031267ef10d79","first_seen":"2025-10-18T16:01:39.40745Z","last_seen":"2025-10-18T16:01:39.40745Z","times_seen":1,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/USDTRY.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/USDTRY.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 263555\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5385D5B3434A7EE56\r\nAccept-Ranges: bytes\r\nETag: \"06102CFAA1F2EA921099C5D05372B1F0\"\r\nLast-Modified: Fri, 19 Sep 2025 00:06:08 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 1216332510937715383\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: BhAs+qHy6pIQmcXQU3Kx8A==\r\nx-oss-server-time: 27\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":263555,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 549 x 548, 8-bit/color RGBA, non-interlaced","md5":"06102cfaa1f2ea921099c5d05372b1f0","sha1":"834989f141ea42a5448252fb87565fc855154e27","sha256":"1f90ca7884e7eb19f0b9f5b761fdb510b51ac65556076ed0723c25204f334d84","sha512":"8bba3b6aac3e6022d262d48ec5a4102ade25e89f061af332897b739f343b7ed816c0b6f2413d8dbf948e95c20a8f8805ea1f23d20e3e01c0dfa03577ad8e47ff","ssdeep":"6144:/hRCmX2AR9oUkaa6JjcuEwicqIc/iPePJUmLg5sQNWGt+G:/hCADrd3licqT/iGB1Lg5s0+G","tlshash":"0844230c1ed2a5f4211806759e36907b45307dbe3906cca2e4e99254fea0ce72ebee17","first_seen":"2025-10-18T16:01:39.41177Z","last_seen":"2025-10-18T16:01:39.41177Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1832,"timings":{"blocked":1583,"dns":0,"connect":0,"send":0,"wait":202,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-res.oss-cn-hongkong.aliyuncs.com/echo2.02877f2fcc3f44c6689306d8039a0d20c.png","fqdn":"echo-res.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.02877f2fcc3f44c6689306d8039a0d20c.png HTTP/1.1\r\nHost: echo-res.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 333\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B56AFD36393706F310\r\nx-oss-ec: 0003-00000905\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":2126,"timings":{"blocked":897,"dns":24,"connect":297,"send":0,"wait":298,"receive":0,"ssl":606},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-res.oss-cn-hongkong.aliyuncs.com/echo2.0c9d4ed570f5647f7b3d0421321c601e6.png","fqdn":"echo-res.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.583Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.0c9d4ed570f5647f7b3d0421321c601e6.png HTTP/1.1\r\nHost: echo-res.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 333\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5EE24003733C80C06\r\nx-oss-ec: 0003-00000905\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1395,"timings":{"blocked":1125,"dns":0,"connect":0,"send":0,"wait":270,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getAllSetting","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getAllSetting HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/charting_library/charting_library.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.097Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /charting_library/charting_library.min.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-2a6a\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10858,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (10857)","md5":"8573e89d9ec535663d75f21b1f08109c","sha1":"a8d9eea0b157ceeffc38d4254e6f6abc9d697d10","sha256":"cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151","sha512":"55d728fa1e0682725f94b17387c6790792d3d34b43652a00097876118575bd6cefa20916d80674519005d72f20ecbb745e9645516c056e6f9bb6691d5efbcb33","ssdeep":"192:9fdWSo7ktFUnoBelr6lw2LfnzuIQPlaJ1i10K+Ei/ISJhvHIheu5Ph3Ffam:vWS2ktFUnoIlD2LfnqIJimK+5/ISJhvu","tlshash":"6e224f58ed2478720acb54f0427f180f8239e278d84944ed3cc4e6ec59fd44a6a6fbb8","first_seen":"2023-08-16T00:37:19Z","last_seen":"2026-08-02T16:01:39.462111Z","times_seen":1325,"resource_available":true,"data":null}},"time_used":618,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":618,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmepb","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.948Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmepb HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"33b7786085010aa92d14f62264fcfcd7","sha1":"42437d293501dba19f6bb6e55ad05a83aa9b5c77","sha256":"fa97b102d9d9bf5feaa015de1c025bd4aa86149c898b3c6d108bec3acb4bc4eb","sha512":"f49b335157fe8e7198883439054f7fb9098983c6e250f97639fd1020e4134d1f1b7aab34f33959ecfe95f4020dbcba89c782a3ef33bcb82f0130108481aaf8ae","ssdeep":"","tlshash":"e09002555c1c8242a88300a5950b1604042431a0262993484d59562591c85a22048858","first_seen":"2025-10-18T16:01:39.419576Z","last_seen":"2025-10-18T16:01:39.419576Z","times_seen":1,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=dcec","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.150Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=dcec HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"9dec91e7aeed0e4528152e047a61fd4c","sha1":"c482f71aff11f9c1e70beb012273eadd3c207651","sha256":"920414f031a42cf719f77f2b41d511d145c5b886b0656b436d42fbd2a4c8a6f0","sha512":"39478d06a30c382757bd70a875299ef8aff281c134306570f404be0ab87d6df916de064d8a89dcfdfc73442bd8ff9b5dde8963784fcc5976c1c13850b8f183e7","ssdeep":"","tlshash":"cc9002565c5c8243ac8300b5950a1a0400243160362493484c595125c4882a22044859","first_seen":"2025-10-18T16:01:39.424159Z","last_seen":"2025-10-18T16:01:39.424159Z","times_seen":1,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=cmefc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=cmefc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xauusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.344Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xauusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"4858ba2a930180dc7bb06ec9318915bb","sha1":"ba75b16cbfc88ba780f98448cb292ae1c2f74520","sha256":"aa69cc67cbd15a8213a869df9130e0ef54b04efd34a60af86d1c5b6eed38c851","sha512":"bd1636b9f2e09fed9dd00ac2f5bc17623649ad8e18a55dc8aea3fa720c4d31cb22cba11c00722754609f74f2228e615f134513c7229cf9a2a8632d8254288ea3","ssdeep":"","tlshash":"a39002595c1d8242a8c300a5a58a220804283160262592484c59516580c91a62044868","first_seen":"2025-10-18T16:01:39.42872Z","last_seen":"2025-10-18T16:01:39.42872Z","times_seen":1,"resource_available":false,"data":null}},"time_used":416,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":416,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmesn","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmesn HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"f441189babaa1ede5e12bd2c64a3988b","sha1":"d20d0b158ef9a6dc4be11d599ce4eaec683d44c6","sha256":"84b0187267fe87b19780a6bb85e1e3bed32e0e162fb652132836546243fecbd8","sha512":"acf61dc3867ddca1ca87b6e210b86a2ea2fbb8cd0be17e65d8c6219ec99b17ceb4683c7195dfd406b319ae4de02c805179c2d8de8b0d09ca135ae5189392e210","ssdeep":"","tlshash":"c79002695c5c8256a98300a5950a261400643160266493484c995525c0881a22044858","first_seen":"2025-10-18T16:01:39.433219Z","last_seen":"2025-10-18T16:01:39.433219Z","times_seen":1,"resource_available":false,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"echo-res.oss-cn-hongkong.aliyuncs.com/echo2.0d2d169261acd4ec38301f0463f4d3610.png","fqdn":"echo-res.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.577Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.0d2d169261acd4ec38301f0463f4d3610.png HTTP/1.1\r\nHost: echo-res.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 333\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5AB673236324D9A09\r\nx-oss-ec: 0003-00000905\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1254,"timings":{"blocked":-1,"dns":22,"connect":304,"send":0,"wait":304,"receive":0,"ssl":624},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xpdusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.584Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xpdusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=czcers","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.606Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=czcers HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":389,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":389,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszw","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.622Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uszw HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmepb","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.352Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmepb HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"6b6930fc0a5859165158388bb5fc8ae8","sha1":"9d62b9239279ba0de90eb9212467b696618d8b99","sha256":"ce56144787d4c9de5cf9d1af53291f8341bbbe3d727cfdf757097554e520136d","sha512":"f9920251ff52a5e32a6b4aa5450885c56ddbb2436b600960a11140cab813656fe0320bdde37a9e962a3c39742be8557680c1df73647e1ee9eda5db180f81bf1e","ssdeep":"","tlshash":"8b9002555c1c8242e88300a5a50a160404253160266893484d59562580d85e22044858","first_seen":"2025-10-18T16:01:39.43995Z","last_seen":"2025-10-18T16:01:39.43995Z","times_seen":1,"resource_available":false,"data":null}},"time_used":406,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":406,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xauusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xauusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"0df3611ad53674baf65717172893f538","sha1":"fb4927a1fe761cca6d669f016514b23af6ca7161","sha256":"cad187850788b513afe1419bdc544164e54a97d8735d54594ec23eadc060b959","sha512":"6072567b1de989d77d6af5997247be57e41ae4045327ad4e5a97dc9d5680e58564be40ae2524078017a0e751c862f0554a96a39fbf689220e6ff1d5d6b763cb3","ssdeep":"","tlshash":"2b9002569c1c8242ac9384a5954a2204042431b02625a6484c59512590cc1a62444958","first_seen":"2025-10-18T16:01:39.444487Z","last_seen":"2025-10-18T16:01:39.444487Z","times_seen":1,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":216,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"mitradel.top/img/MGC.BkHcTfMt.png","fqdn":"mitradel.top","domain":"mitradel.top","tld":"top"},"ip":{"addr":"172.67.216.30","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.833Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mitradel.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 25 Aug 2025 08:10:51 GMT","end":"Sun, 23 Nov 2025 09:08:32 GMT"},"fingerprint":{"sha1":"81:05:A2:56:50:2F:98:F8:E6:52:7E:95:75:7F:FD:FC:72:1C:B6:64","sha256":"74:02:6E:02:2E:3B:64:55:1A:A5:EC:5B:F9:9D:5F:EB:55:99:C4:56:16:B4:87:7F:B6:F8:35:4C:37:5D:B0:48"}}},"request":{"raw":"GET /img/MGC.BkHcTfMt.png HTTP/1.1\r\nHost: mitradel.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 83531\r\nserver: cloudflare\r\nlast-modified: Tue, 07 Oct 2025 07:55:37 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"68e4c779-1464b\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7BoNxBMXC88%2F%2FdkkuCm3qQIFxDb20C%2F%2FGoO5ZsLgHGkXEk16JHCYdH3X35MxI79lixKpqAXPw%2FUGakS972TDhd5QZwwY3Kg3sgUvJw%3D%3D\"}]}\r\ncf-ray: 990940483f55c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":83531,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"ba69c8f0db7f91877494210f960d1c40","sha1":"2e962103b09ceb3296b71799eab0b30880ae172d","sha256":"e79982566cdcda01d72d10317a6471ccfecb79edb719e363db6ef8712efeae3d","sha512":"a7c90e6f067c9e0203f6dd683704476df77eb7f3bc4d57ad42e2f8f9a3390417e3ed708afc89130b6a97dff9d93fc481980eeed54d054835cac31bfb2cfb926f","ssdeep":"1536:4mT9P9IxR9TgYTlHNWKL5l+HGubtEfWqxQxpsirNjC9jFQUKvvp8s:BglHNV9cHNqfWw2NWj2TXp8s","tlshash":"7a8302bc1e54fbb57811bd83e9fc03012976e31675e281554c22907478ddeecae027ba","first_seen":"2025-09-22T11:41:07.911131Z","last_seen":"2025-12-02T06:21:43.923824Z","times_seen":3,"resource_available":false,"data":null}},"time_used":2439,"timings":{"blocked":687,"dns":52,"connect":1,"send":0,"wait":538,"receive":509,"ssl":648},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"mitradel.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/bitcoin-cash.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.097Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/bitcoin-cash.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1268\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yrxPJCSMgaEn%2F6eOxiE42U7ksMsN7k2cabCDUu48kI2dBMeAWTyElL53VsghZuP41mvBf2SZEJnf7ni55eHSkYeCxwcygJovFh8lVQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99094044883f783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cf1Qmi2KKzHwD7B_ceyK0V3mS9iVCC1sJpdwOrFCe5DQ:e53058ce5d11ca8af2f155b1bb136c42\"\r\nlast-modified: Wed, 02 Oct 2024 06:37:19 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=20+10 c=0+10 v=2025.10.9 l=1268 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1268,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"845a8c9c3f6613ad9b95d09377eb9893","sha1":"b6643aa405608136144920c06fefbe3a82647be6","sha256":"b6eea92d11161d168dc6b29c370e322b3aa0dbf92d596c307679f20fcd82fdf0","sha512":"60d060f69e2611adc6df165ce43f4cd5d2058482b400b008326115ed38fb7fc1893c44393a521b4d1d5510ef67edb946980974c4a87282ec3331a26f8f6f6a06","ssdeep":"","tlshash":"172174003351d806f8ae1b7610fc421a126391b56a1b94c36861b66bd97ab57df35c1e","first_seen":"2025-10-18T16:01:39.455145Z","last_seen":"2025-10-18T16:01:39.455145Z","times_seen":1,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-pro.oss-cn-hongkong.aliyuncs.com/echo2.02886a9b011f24139ad100c8c98b3026c.png","fqdn":"echo-pro.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.02886a9b011f24139ad100c8c98b3026c.png HTTP/1.1\r\nHost: echo-pro.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 408\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B593A7E936391BAF99\r\nx-oss-server-time: 2\r\nx-oss-ec: 0026-00000001\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1125,"timings":{"blocked":20,"dns":1,"connect":264,"send":0,"wait":265,"receive":0,"ssl":575},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-pro.oss-cn-hongkong.aliyuncs.com/echo2.0c70ab2641d8e467eb5c6a47afc33c467.png","fqdn":"echo-pro.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.581Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.0c70ab2641d8e467eb5c6a47afc33c467.png HTTP/1.1\r\nHost: echo-pro.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 408\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B54C8B373838076483\r\nx-oss-server-time: 9\r\nx-oss-ec: 0026-00000001\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1024,"timings":{"blocked":-1,"dns":1,"connect":249,"send":0,"wait":257,"receive":0,"ssl":517},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszw","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uszw HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"29ecda59a77b00e0905f255554072f6c","sha1":"c153f441c4461c6aac8fb1272b4904d956e65573","sha256":"98f1e6f25b85265d3f5ff3db1976da40d358177ad81a906aedf6b4261e7e3ac6","sha512":"698d931fbe2a333aa97949c7501323e1598972f601650ac9d2a0cfe3acc75667c5bf45cb0eb24330b1568587fd8b055e7f620734bc6e0c607af2edf49a275d14","ssdeep":"","tlshash":"ee9002556d1d8242a88340a5a61a2e0400243160262493888d59512980c85a22044858","first_seen":"2025-10-18T16:01:39.460126Z","last_seen":"2025-10-18T16:01:39.460126Z","times_seen":1,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xagusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xagusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5f468a2b48aa81ee6e7fe1dc1990a17d","sha1":"d28740d984681a00e241aaefbd874f522cab5b2b","sha256":"615afa1dc8081c19f4cf71c551d5cdf529062db77e4f6b417d0ed8eda22bd807","sha512":"00e2412a2513ad96447b63ee1c0175463c84fe0bd7ccadfe9106a827180608a74628eb4b20bce3bd3bd6baf6e08081f74c42846f14a1ae590a5e368e7b7b7044","ssdeep":"","tlshash":"e19002556c1d9242a88300a5e50a2a04006431602628a3484d59512690981a22044858","first_seen":"2025-10-18T16:01:39.464525Z","last_seen":"2025-10-18T16:01:39.464525Z","times_seen":1,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/USDRUB.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.950Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/USDRUB.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:52 GMT\r\nContent-Type: image/png\r\nContent-Length: 191001\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B4624592373579F11C\r\nAccept-Ranges: bytes\r\nETag: \"F982B33652A3D4D993CA828D7C9C6614\"\r\nLast-Modified: Fri, 19 Sep 2025 00:07:44 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 1719776174292903570\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: +YKzNlKj1NmTyoKNfJxmFA==\r\nx-oss-server-time: 4\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":191001,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 501 x 503, 8-bit/color RGBA, non-interlaced","md5":"f982b33652a3d4d993ca828d7c9c6614","sha1":"213f4a7121fa5fbe55cc2593316fc8068da2c4f1","sha256":"cff26f3684c181dd155df033252785e20fa528ff6b88ccc7d5f8702a5b48fd18","sha512":"40e0aa46289ecea1ce23c8d088f669674fe997be4cc41a929a49e71ff07fa51b1d0fa4a392bd544c0c01bbea0d8060359ee41c0cd6f2482a3b7ec54d31deb17e","ssdeep":"3072:cMNddpCd+pS1S4Lfp9jRGZbsa8IPbSj6lvcnCALtmuHn6FkrAPMlg/WoJn7ZdS5:NzCI54LfLjRgbp8IWjivULtRn6Fk8PML","tlshash":"851412f4a07727176c2801a9bd2307f8439cc764f6dbd60939be0a2da956c7c2e2d790","first_seen":"2025-10-18T16:01:39.468373Z","last_seen":"2025-10-18T16:01:39.468373Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1427,"timings":{"blocked":840,"dns":0,"connect":0,"send":0,"wait":188,"receive":399,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/ecoball.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/ecoball.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1220\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=x2yHnz9z6AptiPV49n%2F%2Ff%2B6bIlRmsAokknClnEGrDAPa0Yq%2F3RQ5z6PTejzwgx%2BOtfn%2FvjkfJidVPhyejkG%2FyM4TuOtBc8%2B%2BpOAPcA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940448841783d-OSL\r\ncf-cache-status: MISS\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cf0Abr7HBCIWgQnsn_VRgOYGUmiVCC1sJpdwOrFCe5DQ:c534c573d012677f5f89684346a4d86b\"\r\nlast-modified: Wed, 02 Oct 2024 08:30:12 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=52+18 c=0+17 v=2025.10.9 l=1220 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1220,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"3a19a7c3bcc32f8eb5a860ff420118bb","sha1":"e8d29dbfa3ecd8954abc1257a9bc741343f96ba6","sha256":"738597293b886d6bc7c27c626cf926da26cae37808491e76d2d023f021b5e4b6","sha512":"b7fc760c30c093de5828c69ddd77f37f6cfb58d8758a01a838860bfed9f09f1487fd7496f5e9ae2bbe56a4368cfc082a976ccf44903663326a9e30e0a73d2631","ssdeep":"","tlshash":"7721a7135b4e37b6c45f0a7b49950ba6c0b9e612ee2c0a13816cb419bc0b5b4ce18e29","first_seen":"2025-10-18T16:01:39.474107Z","last_seen":"2025-10-18T16:01:39.474107Z","times_seen":1,"resource_available":false,"data":null}},"time_used":127,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":127,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xptusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.350Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xptusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"85660512c6246fc9a24568713aaf0094","sha1":"5d435185fdc6fb9f118da569e0ba77e635c73ac2","sha256":"6ff4816b2cbcd8960c46d5227bf8f43e10b217a1aaa7645aac512000baac2ed3","sha512":"d07443344078f5c9a9f63997eed77989d7121772e8818ce910a416b9a01dbcf18a44fd3d4bb37006be8aa03c6059ed48150b713b97b2d8617c903228f8571aac","ssdeep":"","tlshash":"e09002956d5c8242a88300a5951a160401243260266493484c69512580881a22044958","first_seen":"2025-10-18T16:01:39.477198Z","last_seen":"2025-10-18T16:01:39.477198Z","times_seen":1,"resource_available":false,"data":null}},"time_used":410,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":410,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"webapi.44845.icu/ws/cc362e2d-acfe-4659-86ff-ce217af5d677","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:45.795Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"GET /ws/cc362e2d-acfe-4659-86ff-ce217af5d677 HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nSec-WebSocket-Version: 13\r\nOrigin: https://pc.atfx-iij.icu\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 9MYfa3UuGY4UVF650d3FGQ==\r\nDNT: 1\r\nConnection: keep-alive, Upgrade\r\nSec-Fetch-Dest: websocket\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 \r\nServer: nginx\r\nDate: Sat, 18 Oct 2025 16:00:46 GMT\r\nConnection: upgrade\r\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\nAccess-Control-Allow-Origin: https://pc.atfx-iij.icu\r\nAccess-Control-Allow-Credentials: true\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: LK3Qmh4OU4+bxbpzUqe4oxKZOYs=\r\nSec-WebSocket-Extensions: permessage-deflate\r\nX-Content-Type-Options: nosniff\r\nX-XSS-Protection: 1; mode=block\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1912,"timings":{"blocked":-1,"dns":624,"connect":841,"send":0,"wait":220,"receive":1,"ssl":861},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/fc82f966fa29b2f7001510274dfa1b02.webp","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.847Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/fc82f966fa29b2f7001510274dfa1b02.webp HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:52 GMT\r\nContent-Type: image/webp\r\nContent-Length: 53448\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B49D920A3036E618A1\r\nAccept-Ranges: bytes\r\nETag: \"7B4632615B503EB13A8BDA57875AA466\"\r\nLast-Modified: Sun, 21 Sep 2025 01:45:14 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 6491953473972623240\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: e0YyYVtQPrE6i9pXh1qkZg==\r\nx-oss-server-time: 4\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":53448,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 900x600, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7b4632615b503eb13a8bda57875aa466","sha1":"d6a4aa0c36a2026ce84d102cffc9004286a28024","sha256":"fa26142d8e036e01a3b3f561d08b9d8b6750e1ed8b6e7fc5d530783e08e3ead1","sha512":"c1159dbe2fb47ba86b5c48449f2933989543ce2e695e708dd8a8cfa479977d98070c6573bfe753ada3538b20405aaabb8e9c917a3fccc38ef08e0c6f3812f605","ssdeep":"1536:fv3Id7izY7+A7jFMbmp/VHS0ZNRzSPboV:n3Id72AnFMbiNLyPbG","tlshash":"a733024a9cbdc8935359ebd184f224f01409d8fadd39916f879aa6fccbda2312dd4b04","first_seen":"2025-10-18T16:01:39.480252Z","last_seen":"2025-10-18T16:01:39.480252Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1652,"timings":{"blocked":714,"dns":11,"connect":178,"send":0,"wait":186,"receive":22,"ssl":538},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/AUDJPY.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/AUDJPY.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 208569\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B57CC775313059C3C1\r\nAccept-Ranges: bytes\r\nETag: \"7AF10B7605FD7C0589B2FE80A7015E57\"\r\nLast-Modified: Fri, 19 Sep 2025 01:07:03 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 9062996810345689136\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: evELdgX9fAWJsv6ApwFeVw==\r\nx-oss-server-time: 15\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":208569,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 502 x 486, 8-bit/color RGBA, non-interlaced","md5":"7af10b7605fd7c0589b2fe80a7015e57","sha1":"8a8e4f79701fe18ae93877c7c3f1e9d1dc426df7","sha256":"c34083696ba261de24663f20c4d2a9b3d539452bdb817d893acc20e76cbb64bb","sha512":"37c40e4afb9bddbbad34a615f07522e38900624f8dce993a6aafb1b2bd8ec5f80eaf82c1d37ca64f686353265ff2a092560b1a291d92ffd7adb129e201aee06c","ssdeep":"3072:IWsHGXv5f9LULLCJVt+XsJhbbwam0YQ0fPv3G/bi8Rosq7rWFVR9+AEd3OjrZ6Kd:IRmJ9LEE+Jl04np8RkmFJFZ6WCn96BNP","tlshash":"6f142256b57466c1bcafcc00dc7703983935af2573ba66202a60c3756a5d36b63b8bf0","first_seen":"2025-10-18T16:01:39.48351Z","last_seen":"2025-10-18T16:01:39.48351Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1822,"timings":{"blocked":1600,"dns":0,"connect":0,"send":0,"wait":191,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/USDZAR.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.217Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/USDZAR.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 510150\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5624592373505F51C\r\nAccept-Ranges: bytes\r\nETag: \"1463E9B391063B236BB2066056EDD19C\"\r\nLast-Modified: Fri, 19 Sep 2025 00:09:27 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 13266547005210537319\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: FGPps5EGOyNrsgZgVu3RnA==\r\nx-oss-server-time: 21\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":510150,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 733 x 748, 8-bit/color RGBA, non-interlaced","md5":"1463e9b391063b236bb2066056edd19c","sha1":"3c0b4c5e0074ac38e13b539d7e08fb0f49432c0c","sha256":"e679fe5390f3f7d29edc5cf51d37a830b10ec853fa15ef8e5aab0280e2418761","sha512":"1613170479069390c3f13da567d8954209777372ea0aeec5ed9e6da9212c8177727935f18a5a8249633f53ead250f6443e7af5980883e9a2dedde5a8a5d2ca1e","ssdeep":"12288:/uoZjf47XJb/FRV5Jie95zy/E8tS2smAoplBeQU/X46M:bQ7F/t5Jl9NqOmVBe1/vM","tlshash":"36b42397a8ed5193cccb9acf39cd852f396e90b9e10b3f01d8760143190b4ea93bd656","first_seen":"2025-10-18T16:01:39.486774Z","last_seen":"2025-10-18T16:01:39.486774Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1965,"timings":{"blocked":1565,"dns":0,"connect":0,"send":0,"wait":201,"receive":199,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-pro.oss-cn-hongkong.aliyuncs.com/echo2.082b846673f16450abfacfe31925d25ef.png","fqdn":"echo-pro.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.579Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.082b846673f16450abfacfe31925d25ef.png HTTP/1.1\r\nHost: echo-pro.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 408\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5B1E8233436F60D08\r\nx-oss-server-time: 2\r\nx-oss-ec: 0026-00000001\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1193,"timings":{"blocked":-1,"dns":22,"connect":278,"send":0,"wait":281,"receive":0,"ssl":610},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmesn","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmesn HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":385,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":385,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmesn","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmesn HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=nymexpa","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=nymexpa HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c37922555cdfdee4e96a8b086f9d3c06","sha1":"aa7026a786dbafbfb4321e559152aa08c2b57800","sha256":"385c85adedc3da742b434ddf87f9187d64d5853b8b3a4ce67422563dbc00500a","sha512":"b346f3567fde4db0ea0d1817a667a210161c64127e61b37d22ee99e8c72f775e24bd657f7f8bdafcd0af42d589efb889c53ae8268c560572d2fd707ff2e72c99","ssdeep":"","tlshash":"779002556c1c8342a98310b9950a160400243160262497484c59912580881a22044858","first_seen":"2025-10-18T16:01:39.490124Z","last_seen":"2025-10-18T16:01:39.490124Z","times_seen":1,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/css/views.3dd011a4.css","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:45.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /css/views.3dd011a4.css HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:45 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-798ee\"\r\nexpires: Sun, 19 Oct 2025 04:00:45 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":497902,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"4fdd43c387eb62a2d09e554396149bb6","sha1":"22f5a316a7de8a9156276a8dd38f60cb51a32acd","sha256":"7bbb0c5c9a62fb81cd96b899a8fd9df7eca561e4c4d2b2cba03b0807bbae8bc8","sha512":"d5a0efccd2400dbde5b83a043823b2dde7cbeea781cdafba4b8a036e73f2353be120fe7be2b9e6f0a85027be814ad3e6170d56c6f475ae907ca9525c35f64423","ssdeep":"12288:LWJxBhsAlTv+503BDmQMjzNlqB4LsOdn371ml69RZiQuOCXLRdd4sMZx+aby:ilTv+503BDml3bw4LsOdn371ml69Fwgy","tlshash":"b5b4a823732a2929b17bca3861c0779b3618e773c10352f9de91a829cbc7583376675d","first_seen":"2025-10-18T16:01:39.49306Z","last_seen":"2025-10-18T16:01:39.49306Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xptusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xptusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/avalanche.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.894Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/avalanche.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1372\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8QLP0DrcB7K7UJfYirh8Zgd2k1FFk8oKSkTO0v%2BbH79eM6tag38PmGNMZM2XvCuZBfUSTHckPiL0A1B54HYZuV3WRAQQx9%2B8FGXR2A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940441ed1783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cf19-a2Mp-v_kStvhdvcPWXQEDiVCC1sJpdwOrFCe5DQ:b213e74510307246a720fe43762b745b\"\r\nlast-modified: Wed, 02 Oct 2024 06:11:54 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=13+9 c=0+8 v=2025.10.9 l=1372 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1372,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"dbf0dc7aec9d2b6aa6bded6abf6795f8","sha1":"3382c6af982069caf2430290b00bfc363ac39910","sha256":"eb8ecbdd08ca0da6a705bc259c478da02095b4eefa4dd14abd35a136bf5850b6","sha512":"4a30dfb0080aa771fa154e35f079b19a4f6af929e502146e11de332730e9ecbf623366d9ae98d69c07962ca96a9513513ef0aec5006e3a7712f865473596e17e","ssdeep":"","tlshash":"fb21c51bf3e4c805e4bc9230084f40767322aa55063adae9e6c539a59a713b1df68e38","first_seen":"2025-10-18T16:01:39.496519Z","last_seen":"2025-10-18T16:01:39.496519Z","times_seen":1,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":92,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.harvestplus.org/wp-content/uploads/2021/08/Orange-maize-2.png","fqdn":"www.harvestplus.org","domain":"harvestplus.org","tld":"org"},"ip":{"addr":"172.67.181.244","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"harvestplus.org","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 16 Sep 2025 11:45:33 GMT","end":"Mon, 15 Dec 2025 12:44:17 GMT"},"fingerprint":{"sha1":"E3:61:D7:67:A8:CA:B4:D3:99:E7:E4:02:72:3C:15:7F:05:AC:73:91","sha256":"06:82:93:75:59:68:2A:89:95:A7:74:16:A2:7B:7F:B3:E4:3F:C2:66:5C:E3:2D:59:2E:C9:B4:04:C6:3D:EE:FE"}}},"request":{"raw":"GET /wp-content/uploads/2021/08/Orange-maize-2.png HTTP/1.1\r\nHost: www.harvestplus.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 463564\r\nserver: cloudflare\r\nlast-modified: Wed, 16 Mar 2022 20:34:01 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"623249b9-712cc\"\r\nexpires: Tue, 13 Jan 2026 08:48:29 GMT\r\ncache-control: max-age=7776000\r\nx-frame-options: DENY\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\naccept-ranges: bytes\r\nage: 285143\r\ncf-cache-status: HIT\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sRMp42a1iEPIGFFsMA1%2BZw8RGFu%2FpIXtcURlEEuZeALJzFdmNOIeN6WA3x5FNStbsexOXfMjC5rUgnPTJrCZdXoFWYZ1Jj4M4V8b6Ym6reZM%2F3I%3D\"}]}\r\ncf-ray: 9909404c19334c11-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":463564,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 756 x 558, 8-bit/color RGBA, non-interlaced","md5":"2a073bf4674a23d6acd058bc6c4a7ed1","sha1":"5068cba3ab8f25ecf666613ed96adbe1b6278f23","sha256":"b4109d0f5cd92b4222fd78d495234a7f410a48fb598f47921584ed33395d02c3","sha512":"63b9e5280ba87087c5418c27a97828b3da171962a19fb1ce68de3da65bd72b93a7a90e47d64d9061f56f802d12ce2246dbea847466d609ce413c008678861389","ssdeep":"12288:hPceIOum98WMgGMsfsYw7rxgO0iu9wnQuJSrfj:GeI1GugpsEl7OO0iu9wnhMrb","tlshash":"38a42327bb007aafef6c43d662c87f62d0a51482b865533c64c3b16f0e7fa54c5619b2","first_seen":"2025-10-18T16:01:39.499894Z","last_seen":"2025-10-18T16:01:39.499894Z","times_seen":1,"resource_available":false,"data":null}},"time_used":995,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":11,"receive":16,"ssl":958},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"echo-pro.oss-cn-hongkong.aliyuncs.com/echo2.0c4b6c100a133493186c7f4aae8a91790.png","fqdn":"echo-pro.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.580Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.0c4b6c100a133493186c7f4aae8a91790.png HTTP/1.1\r\nHost: echo-pro.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 408\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5AB4B813638B5254A\r\nx-oss-server-time: 5\r\nx-oss-ec: 0026-00000001\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1207,"timings":{"blocked":-1,"dns":21,"connect":286,"send":0,"wait":291,"receive":0,"ssl":609},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszs","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uszs HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":378,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":378,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jxauee.com/favicon.ico","fqdn":"jxauee.com","domain":"jxauee.com","tld":"com"},"ip":{"addr":"109.104.154.97","port":443,"asn":136258,"as":"BrainStorm Network, Inc","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://jxauee.com/","date":"2025-10-18T16:00:43.246Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jxauee.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Sep 2025 22:31:32 GMT","end":"Fri, 26 Dec 2025 22:31:31 GMT"},"fingerprint":{"sha1":"B0:5E:25:EE:D2:03:9B:2D:D4:16:86:4B:AD:7C:70:DF:83:C7:27:68","sha256":"B4:19:9C:66:61:9D:9B:E7:9F:2D:E8:AA:33:9D:81:47:09:81:78:D4:F4:A8:FD:7F:3D:9F:37:01:D4:61:3D:F9"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: jxauee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://jxauee.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sat, 18 Oct 2025 16:00:43 GMT\r\nContent-Type: text/html\r\nContent-Length: 138\r\nConnection: keep-alive\r\nETag: \"68ba9dd2-8a\"\r\nServer: nginx\r\nX-Cache-Status: MISS\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":138,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"7389d931c86b3d7bb6b8af46d8c4172b","sha1":"8d2a4760aa0b47984d11cd1a66448719177fb791","sha256":"301bd9f16f94feedfae7a946a14bac38cb73c43efe6117bc5586835af03d7d6f","sha512":"dd6d1511e4fcd5bc09d821ffe091fb5946ac9654c48664aed504e479e9ac20c1cad44b6df90f42190d47e28f5f96bfb09d24056df6b950243d68ee8100a9a889","ssdeep":"","tlshash":"d9c09b5d755366449913155167c33641d196837f689a84510941c593f0cf69ac4c73a9","first_seen":"2023-03-13T12:56:15Z","last_seen":"2026-08-06T11:17:02.632525Z","times_seen":316809,"resource_available":true,"data":null}},"time_used":254,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":253,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=cmefc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=cmefc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"4479a27234595120e7b7414b3a0cb035","sha1":"d0a39d0efe15046be2222cfddd4af3c264577d74","sha256":"add1250ce2d297020d0417cd1ca2a0d6ae8dc9298b21075150af70820a51e06c","sha512":"b149fa9be57427bb553d4967bb650b6f13ab4557066c7d1cf8d6033a1c37257928966e077bd99f8e3285be5df92529bd9b8117719e8fca01861bcaf3ae21bc05","ssdeep":"","tlshash":"fb9002565c5c8242bc8340a5aa4a220400343170372492484c5d512590dd1a62084858","first_seen":"2025-10-18T16:01:39.503276Z","last_seen":"2025-10-18T16:01:39.503276Z","times_seen":1,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":209,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/ftx-token.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.904Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/ftx-token.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1048\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=s5ljrWaVmUuHArTUZt11yrCnWScZrD3Hyp4QJ8Y1o3R%2B2vYHWEWlhqx%2B37PkbuReEx1yFaG2vyrZO4ZzuaXgsToGbd1F%2BUnIVyTg8Q%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940442ef3783d-OSL\r\ncf-cache-status: MISS\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfnVVodwj2TAuSOcJzkp596tShiVCC1sJpdwOrFCe5DQ:35c2d9a1c88cd943683d4065676b8a0c\"\r\nlast-modified: Wed, 02 Oct 2024 09:14:54 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=574+12 c=0+11 v=2025.10.9 l=1048 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1048,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"19b354e7668cf27a1ca05ed25cd5f562","sha1":"f61c885043847befe779e4d5ffdc390bcc77e28e","sha256":"cb75e71a01563978cfd3d3033258aeee4d1f2f3108aab62851942a0b6f18b3c9","sha512":"9f1b3a94cfb586bed72c442fc1701b1e88092c302d499101e150aa64dfe08fc4c6b1415173b250083483a58db09d7e818945630893d05b0eb7cfbc5dc57f42d0","ssdeep":"","tlshash":"92119429f3513890c5bc033788cc9e483242753572161a8b3861bb5c8871f57ee60ebc","first_seen":"2025-10-18T16:01:39.50645Z","last_seen":"2025-10-18T16:01:39.50645Z","times_seen":1,"resource_available":false,"data":null}},"time_used":649,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":649,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/gamecom.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.911Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/gamecom.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1425\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U8f7Rgkx%2Bix2ThIkDvQsJeYFiWrUiarTtNHfr1HlPTrKuIoNSVb82tLvMQ3pstOa5Nbx2SUBBxtOCYpgvl%2FPACGbH4xcOQQdwIewUg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940443f31783d-OSL\r\ncf-cache-status: MISS\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cf4oCO_Sv3jJB6YJ36uSFoUlhviVCC1sJpdwOrFCe5DQ:022c1726c6cf815e8c256e3c43e4dcb1\"\r\nlast-modified: Wed, 02 Oct 2024 09:20:16 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=23+11 c=0+10 v=2025.10.9 l=1425 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1425,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"11aadd2526bcabf3f6ebfc703025ee78","sha1":"e7477ae8c80bf890613058bc53c4088a36041757","sha256":"3838a2ef164b472e63c63ea6d032dbde9bc11405331b75b6c541fde2defb7ef9","sha512":"e84c9d184c208ed2b519c615058bffae533ef2b4033716637fe36e4577063b14071455e185cb475a9ea23ff6ffb35d5f58ec68135ec4c63402642ea37ae3f8c6","ssdeep":"","tlshash":"fa21083ad3fa5e0ae90d617a055a423014743e68532b8a636e08b2044b36532de60c7c","first_seen":"2025-10-18T16:01:39.509982Z","last_seen":"2025-10-18T16:01:39.509982Z","times_seen":1,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/250px-Palladium_1-noReflection.jpg","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/250px-Palladium_1-noReflection.jpg HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:52 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 8218\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B46245923735DEF01C\r\nAccept-Ranges: bytes\r\nETag: \"028B22F847F6FACD18145A0800675A2E\"\r\nLast-Modified: Sun, 21 Sep 2025 01:48:18 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 10917941242624961257\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: Aosi+Ef2+s0YFFoIAGdaLg==\r\nx-oss-server-time: 3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":8218,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, comment: \"File source: http://commons.wikimedia.org/wiki/File:Palladium_1-noReflection.jpg\", baseline, precision 8, 250x205, components 3","md5":"028b22f847f6facd18145a0800675a2e","sha1":"b04f551f70ff206d1edcc1d8533ad0e41f36753f","sha256":"8ce79602bf8a88134bdf9090459fa95f88895facbe0dafb563728fcdb9021fad","sha512":"fca955f85de47d2968b0afac03d3d4431b3c8ec38527f3718a288348df3ec2155bc79ee1df7538ed50421ef73f7405ed5aa9d32f231e0ab93c4d69e366efa980","ssdeep":"192:nilm5csOrG8I4/6wIuNWF9947yZAts9I8h7jLM+Jk4dAJh6:niw5JLhJwI9zAW9VhbM+3GJh6","tlshash":"fc02af8db949a036c219f8f910b75b8e8390e5b23f11ae7f74c4535cd47e7ce4a14899","first_seen":"2025-10-18T16:01:39.513905Z","last_seen":"2025-10-18T16:01:39.513905Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1613,"timings":{"blocked":696,"dns":0,"connect":176,"send":0,"wait":180,"receive":1,"ssl":558},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/litecoin.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/litecoin.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1272\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BWzaOnjWjGfNJk6RRR%2FpwHa3AbFRTn4bIcvzDLHJQtIN9Ox69bKtDVEi9oA5xyPMe0HfGcbfnQbdXH6OAwQDeTq%2B%2FzOjGGoXoqJi8g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940445fc3783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfcMYMorALzbsc6PReHDZNb9ItiVCC1sJpdwOrFCe5DQ:2417d3dc66a2667951bc12251d511151\"\r\nlast-modified: Wed, 02 Oct 2024 10:49:41 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=10+5 c=0+5 v=2025.10.3 l=1272 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1272,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"9b6335e546ab35d82454afffe7d8a33e","sha1":"d667ab7aa79a28470432d66590a9945ba1c40213","sha256":"91c2ea56d63c2ea98443a23315422aee1ada39ce451071b0af15217e6e6e9f23","sha512":"92d7f33dc14d784eaffa236ceb858fda1dd36e89dfff387879597f392d0262376f105c58119387fee14608b727d357ba5f80f47033cf443be356179a815c3f38","ssdeep":"","tlshash":"5e21ca00b3746b04e47c5378015c09562261f059577f9b52c1107a95cf36b75ee0de7c","first_seen":"2025-10-18T16:01:39.517686Z","last_seen":"2025-10-18T16:01:39.517686Z","times_seen":1,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/EURAUD.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.949Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/EURAUD.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:52 GMT\r\nContent-Type: image/png\r\nContent-Length: 255944\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B49D920A30368019A1\r\nAccept-Ranges: bytes\r\nETag: \"4853B435BE4E29AA089C3ECAEBCE64F9\"\r\nLast-Modified: Thu, 18 Sep 2025 23:45:43 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 4835564694144315066\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: SFO0Nb5OKaoInD7K685k+Q==\r\nx-oss-server-time: 30\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":255944,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 494 x 488, 8-bit/color RGBA, non-interlaced","md5":"4853b435be4e29aa089c3ecaebce64f9","sha1":"8e497f4f0abb936e5eaa32b8a46a15affd93e04e","sha256":"a437a61e39547a34db76ece5e89783749938a50c1602cc10ed423c3a876418b4","sha512":"b542b7c607a9c37eb69f7d927d5475e2575cdd034f51e881480f284b5e2c1ea38897b32f3e399407819dded8173519bcdbe1d8fb85ae6be70880ba12339d9808","ssdeep":"6144:Mj8PBrNeYksYyhEvTY1K22uTBqt9Msy2BM+t:pPBrNeY9Evr22QsMit","tlshash":"8c4423f53a2c61d1fa0b0dbff4647774f24f821b59942cb4db2049e99905202a95ff72","first_seen":"2025-10-18T16:01:39.521149Z","last_seen":"2025-10-18T16:01:39.521149Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1422,"timings":{"blocked":820,"dns":0,"connect":0,"send":0,"wait":215,"receive":387,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mitradel.top/img/ZS.Crp75kV-.png","fqdn":"mitradel.top","domain":"mitradel.top","tld":"top"},"ip":{"addr":"172.67.216.30","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.243Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"mitradel.top","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 25 Aug 2025 08:10:51 GMT","end":"Sun, 23 Nov 2025 09:08:32 GMT"},"fingerprint":{"sha1":"81:05:A2:56:50:2F:98:F8:E6:52:7E:95:75:7F:FD:FC:72:1C:B6:64","sha256":"74:02:6E:02:2E:3B:64:55:1A:A5:EC:5B:F9:9D:5F:EB:55:99:C4:56:16:B4:87:7F:B6:F8:35:4C:37:5D:B0:48"}}},"request":{"raw":"GET /img/ZS.Crp75kV-.png HTTP/1.1\r\nHost: mitradel.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-type: image/png\r\ncontent-length: 78372\r\nserver: cloudflare\r\nlast-modified: Tue, 07 Oct 2025 07:55:37 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\netag: \"68e4c779-13224\"\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Ybncts%2BZRZPsXlWell%2BQqE4TmPSbFKpP7n%2FYuGXvzeH4xsCl0mo1JawKELAplqKxYDs99PeH%2FoUpcwpgam%2B48vtIU7haDYuIDyaSdg%3D%3D\"}]}\r\ncf-ray: 990940485f96c759-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":78372,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"802f0e7e46cd69ec020c371ef879a6f5","sha1":"af030a305f3cd4f0830a4fed0562a93fcabccad8","sha256":"86922e43a5cb223d3637350e96100f57834ed713a249306236bb898331eab597","sha512":"f007e21ef724da5b291564a4bba6e72c366eaebef4a329f3f69afc8c5098babf8bef327e63031060cb56e1fa1b918516a6b5c66fa237e119d3f17f12f3d666ba","ssdeep":"1536:X2f8xYwdlQ2NX8DcYmS6iNy6r0fwzUZAy2Y+GJOf2W:U8e2JNX8DcY56iF0fmy2CU+W","tlshash":"17730266eaf8842d098798aa0713c1176173b875fc7d7eb3988bac631c4d0b6d2d4d1e","first_seen":"2025-09-22T11:41:07.935538Z","last_seen":"2025-12-02T06:21:43.876972Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1609,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":554,"receive":472,"ssl":580},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"mitradel.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=comexgc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=comexgc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeah","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.952Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmeah HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"9aabc399f43091ffa5a229e339758937","sha1":"7bca59982837dd4ab38cadb33ba7e742a2a4f85b","sha256":"41ba8c79a4bfd2489e6d0de93b9124331d579913cc8c02cdc534d263de02a451","sha512":"12c8ef4bccd3ca5dd64d93f60b56d4433b6ed6423720140e9fe1de90329d1199c5c72fe36ec9f3fece773e7f7f9accfeb23d851824ceecc70ced2008ac6292ff","ssdeep":"","tlshash":"749002565c1cc642a88300a9a54b260400243170262492488d595525c0c81a62044858","first_seen":"2025-10-18T16:01:39.531273Z","last_seen":"2025-10-18T16:01:39.531273Z","times_seen":1,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=webp/logo/1/ethereum.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.852Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=webp/logo/1/ethereum.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 908\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=f4Ivdm%2F3tXccGfd6%2BrxTOtN61KQH%2BpPMGfAxuKc3xZwZhYMF78570vHIBUf9Rfk723by0SnHrJkvuTHzHYBDcOVrLLjDwv7XQ6H3og%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940441eda783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfjlYA4vSmlPQgH2SP39w81o4EUIOyKwvJ4Ys7e8c_DQ:62ade6f22972078ee3b339e3ed03836b\"\r\nlast-modified: Wed, 02 Oct 2024 08:47:44 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=183+3 c=0+2 v=2025.10.9 l=908 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":908,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3fe7a4e5e8245a8043205af6c1fc5937","sha1":"9b3225cb3adeffcd401c59804583e452ca1f571b","sha256":"49dbaa50e87cfba24092b8f006bbabe4bede2db4c3156ecf85db12bcc45306fc","sha512":"1be333aa28ac1d1831ce2d40c281a67619de393cb87e1c7a21819b3ea61fe67ba5bd6f765d120a351359a0253aec74638a363c77522a966139326cd18e869304","ssdeep":"","tlshash":"3111c8f998c71512b32106107eb5c7f4da36652441f1c81378485ef042411b01910cae","first_seen":"2025-10-18T16:01:39.535086Z","last_seen":"2025-10-18T16:01:39.535086Z","times_seen":1,"resource_available":false,"data":null}},"time_used":112,"timings":{"blocked":3,"dns":1,"connect":1,"send":0,"wait":78,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=webp/logo/1/dogecoin.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.863Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=webp/logo/1/dogecoin.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1694\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Pqw5usvQMMUCXGb4VCyb7y112CBIgeJ2P1DPeXW5g7f5hc42FCKFpVJGptZ%2BPz8sQuyQK2Aji5lhNHZpKtJYWc9Ku7kE10IC75Ls%2FA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940441ee0783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfOO81tugSex2l7gfkam-3tGswUIOyKwvJ4Ys7e8c_DQ:a522fb5933eda0513c938c853f390ef4\"\r\nlast-modified: Wed, 02 Oct 2024 08:17:21 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=15+3 c=0+2 v=2025.10.9 l=1694 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1694,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b45a3f30caebe795bf5376cb9d88a146","sha1":"e5ff9ac1f6e850f3f2162ef4faf13d75abf14d0d","sha256":"8925ebaeb997674c123934a670a8aa8b3c8604a4b9ac1126d5ef2ec80b01b6d5","sha512":"5c1d1f02f268393152edc4f74b718f271e355a76e4ae79a769cdb87d9dafe5762c4be29c98048c31f49dd2029c07d6127e847b3303548ab7ae59daf75354db90","ssdeep":"","tlshash":"3931fae0155213d2ddcc19fe88278dd1fce2c23150c54cc7893b92583537c592b26b1c","first_seen":"2025-10-11T06:36:30.387246Z","last_seen":"2026-06-17T16:05:42.967124Z","times_seen":4,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":1,"connect":1,"send":0,"wait":56,"receive":0,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uskc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uskc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=dcec","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.616Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=dcec HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":379,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":379,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uszc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":378,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":378,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=comexgc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.338Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=comexgc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"01c3ce3be25b2c6d13e6ae7493e6a986","sha1":"9332f804d7bbc4f8c08bae0bf92e5dafdd0b2c70","sha256":"b0330d92b76c560e8376924213417cf6554dcf913a2e0162477fce002fcd32cc","sha512":"faaa7a83a175e683f8dfdc60c8079eb4625cb59ad15aaefb090070497b4f153ee423eba1c36111200e64fa69f938e4091d1844c82aec27652036908651877c55","ssdeep":"","tlshash":"8b9002555c1cc242b8c704a5950a260400243260262593484c595125d0c81b22044858","first_seen":"2025-10-18T16:01:39.553484Z","last_seen":"2025-10-18T16:01:39.553484Z","times_seen":1,"resource_available":false,"data":null}},"time_used":455,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":455,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/EURJPY.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.055Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/EURJPY.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 183409\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5385D5B3434EAED56\r\nAccept-Ranges: bytes\r\nETag: \"B687CAABC7F32B78CEE043497F8C04AE\"\r\nLast-Modified: Thu, 18 Sep 2025 23:35:13 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 14992784531386079138\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: tofKq8fzK3jO4ENJf4wErg==\r\nx-oss-server-time: 21\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":183409,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 506 x 494, 8-bit/color RGBA, non-interlaced","md5":"b687caabc7f32b78cee043497f8c04ae","sha1":"06adc701a39c81b45995a017d17bb217f9fec1cf","sha256":"9108ee792b5f573164600e883cc1138a8555aeca890d5e612aa2c37465c459bd","sha512":"e5002e5e2cdfe1bfddf9856ee340a13e724b4cff9479d31caf99461245b915a40e40dfebeba9a1da2c446e8d58ea38ed2d9a1d53dded40f8e5a0fe6df06d6c7a","ssdeep":"3072:ygmoabCjO7M43uE3OjAKhLnx1NyL9OUiI5AUcQ6xgARU7zH79qMOaw87Z:ygB03cAKhd1Ny9OiAULuNR0zH7AMdw8d","tlshash":"1504124048df2ea97c0b554c55a2851cc3a73a87ced6b0be430e6a916cad6d4e7ff0e0","first_seen":"2025-10-18T16:01:39.557807Z","last_seen":"2025-10-18T16:01:39.557807Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1747,"timings":{"blocked":1521,"dns":0,"connect":0,"send":0,"wait":196,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xauusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.580Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xauusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=cmefc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.382Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=cmefc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"cc386b70ed339654386cdeb755c07017","sha1":"e4275b62b6a37f139a7b4459b6fdcd066e6fd803","sha256":"e5d18b76cb683144546995d98ec2403fd8b3e7c92396634c26fd3b51b5db39a8","sha512":"a628e6a9431f210f781e10b817e296a57959d761897c0e625691096dd2261b63981861335c0d68d3e1f6c55a3bf8d950795f39e2a3687eecb5098418eb3ed0da","ssdeep":"","tlshash":"649002565c5c8242bc8300b5a94a224400343171272492488d59512590cc1aa2044868","first_seen":"2025-10-18T16:01:39.565495Z","last_seen":"2025-10-18T16:01:39.565495Z","times_seen":1,"resource_available":false,"data":null}},"time_used":308,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":308,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszs","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uszs HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"4dbfa80f5ba74c86a1daec1881405569","sha1":"46c662c92414eac258b903e6823b4f94229a4031","sha256":"02a7e2f9d95e20aa9126de31585d7be4e7a98aa9e6ef3bec18e83be463557ac0","sha512":"57a0a5ca8439dc82f02535496ea60f69efe2d4973c1a6dd20f50e4be876bb77114f899aadbd2b33b24bb229512459d8d11e0bde66810e10561286400ca561557","ssdeep":"","tlshash":"7d9002556c1c8242a98310b5950a1605002431612a2597488c59912580881a22044859","first_seen":"2025-10-18T16:01:39.575732Z","last_seen":"2025-10-18T16:01:39.575732Z","times_seen":1,"resource_available":false,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xpdusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.732Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xpdusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=czcers","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.753Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=czcers HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":377,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":377,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszw","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uszw HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":371,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":371,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=webp/logo/1/bitcoin.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.807Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=webp/logo/1/bitcoin.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1406\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=k%2FFdx%2F4XYlirIp0kujGhaHdjOum8FD7wiuSXrzvndYeW6aWUDQy%2B2pMh%2FyZszkJ11a5pIQZ4VwU6tGikNdQHX%2BsrKN%2BLhrl0kaWuTA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99094043fe74783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfOZtv2x5VgEFY6Kmh3yE5tegmUIOyKwvJ4Ys7e8c_DQ:8452f85bf6782e6306cf6f8961d876f7\"\r\nlast-modified: Wed, 02 Oct 2024 06:38:17 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=12+2 c=0+2 v=2025.10.3 l=1406 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1406,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7ba6ed78b62740fb7cff79ed7fc94621","sha1":"2e37fb035bca34e4bd925a31838490ed6f20c913","sha256":"c1e1fcf7324e768b34d5ace26b206a277fc511f6387b70858900c6053984f010","sha512":"da26accfa693792a0893de85454ce9e774e40728e1bb12f8b3273b6cbd8fe8a44eabe47750e2c3ba516ab3795495e2f88b2c44bada92bf9a76d68aaf04ff2b0f","ssdeep":"","tlshash":"c021db998b118bbffe2bb3ee1a3c44447c5924fc56f31191551b02f5d54cb127e60b26","first_seen":"2025-10-18T16:01:39.580524Z","last_seen":"2026-06-17T16:05:43.108171Z","times_seen":2,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":31,"dns":9,"connect":1,"send":0,"wait":83,"receive":14,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=auto/logo/1/ripple.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.880Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=auto/logo/1/ripple.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/avif\r\ncontent-length: 1419\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=awlaZN9N3Re8xG7%2FyygU1vTTnKMkrbyAIkU1IUrdkc81wjD34ULMk23L90cEfXmOgU5ZF2u5eS6mq%2BEXU0OdmKHNhi%2BAsE6zcoqvsA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 990940440e98783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfW9olw2A5Wv2Vw_XoXjOGPTcGiVCC1sJpdwOrFCe5DQ:c541259f800abb813643ba52c0893101\"\r\nlast-modified: Wed, 02 Oct 2024 13:07:43 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=32+12 c=0+11 v=2025.10.8 l=1419 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1419,"size_decoded":0,"mime_type":"image/avif","magic":"ISO Media, AVIF Image","md5":"f4a6665ed084fe1dc5e18764a0af5c34","sha1":"b152c58079920cdffb3dcbd54553a4cade464454","sha256":"148017a6d012d5070f8293cfc0b05d28473de59a330a39c42a96e4d3f62da820","sha512":"45a489750b99d62b126b6e403f9ca923020c7a5d986f3696ce63311ff71025ff5f39e397fa80351980c4629c56f3966639009856ab997d9fa94eb1b799b3ad87","ssdeep":"","tlshash":"3c21d81bb354680ad5ad5378429eb6047164d27827ba95cf0d60f928e426aa3eed0d34","first_seen":"2025-10-18T16:01:39.584987Z","last_seen":"2025-10-18T16:01:39.584987Z","times_seen":1,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.391Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uszc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"bad3c5af83fd73e60a2aeb4e0ee2342e","sha1":"badbbdc486b7f6abe9c4ed823ac9440fe56bbab9","sha256":"1376329fa453bf7e2289e3551404370acf7a9228d4d53a8cd0209a107e6a8685","sha512":"2e80780b2edcb7d02059e699170664121d7fffa9bf50853f68e2d7f25f4ebfe243e47c87a7c776ab617e49c28e83787d1e9c45d7ef1e1563698804b4b78d0c5c","ssdeep":"","tlshash":"de9002955c1c8242a88300a5950a160400353261262993884d596525c0881a32044858","first_seen":"2025-10-18T16:01:39.596349Z","last_seen":"2025-10-18T16:01:39.596349Z","times_seen":1,"resource_available":false,"data":null}},"time_used":301,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":301,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszs","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.758Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uszs HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":376,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":376,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/e/e6/Lead_electrolytic_and_1cm3_cube.jpg/250px-Lead_electrolytic_and_1cm3_cube.jpg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.924Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 Aug 2025 07:58:25 GMT","end":"Fri, 14 Nov 2025 07:58:24 GMT"},"fingerprint":{"sha1":"00:6B:23:79:C6:3F:3F:33:1C:96:A8:58:E3:42:75:58:02:2B:84:D3","sha256":"AC:53:65:9E:C2:DF:AA:6F:9B:55:55:44:CF:4E:94:5A:41:C1:12:6D:4F:EA:F3:3D:EB:5E:40:17:00:3A:2E:26"}}},"request":{"raw":"GET /wikipedia/commons/thumb/e/e6/Lead_electrolytic_and_1cm3_cube.jpg/250px-Lead_electrolytic_and_1cm3_cube.jpg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 05:17:22 GMT\r\netag: 04743c866e6799b68846ad07b0040aa8\r\nserver: ATS/9.2.11\r\ncontent-type: image/jpeg\r\ncontent-disposition: inline;filename*=UTF-8''Lead_electrolytic_and_1cm3_cube.jpg\r\nlast-modified: Sun, 09 Feb 2025 05:15:38 GMT\r\ncontent-length: 12857\r\nage: 38609\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 hit/37\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=l_oD80-47uXAI7EZ3Rf0fAKQAAAAAFvd5lD2cwhcjdNaawGMOHeid_Z-tHsrJt8-;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 18 Oct 2026 00:00:00 GMT\r\nx-analytics: \r\nx-request-id: 4935ab72-9de4-4815-b7d9-641a22684ab9\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12857,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, description=Lead (Pb) electrolityc, xresolution=122, yresolution=130, resolutionunit=2], baseline, precision 8, 250x159, components 3","md5":"04743c866e6799b68846ad07b0040aa8","sha1":"dcd44a6aaf38ad12938c1355cbda466d24193211","sha256":"aa79818714a2ddb40c776421c9e247475e929ccd33df802759cb8ae31c52e80d","sha512":"ec043340a5a7a539ae4152f478de60dc6aa957e2977806cb4cc78781062b07a8468e73722e1cebe5bb04b8902fcbe2aa8f8561f380bdd326fd5d97658cb6cd73","ssdeep":"192:hLgVCfRJC1TBonPDw/gAhZLfZGbbrXdaB2zBw55qOAnxIXo9TM3FaR:hkVCDuTBobwVhl8TdaBEBDOAxIXETAwR","tlshash":"dc42cfe9476d1888d72792b098dbabd1cb21fca9cc5b574531688b4c6f8930317ca0a6","first_seen":"2025-10-18T16:01:39.600703Z","last_seen":"2025-10-18T16:01:39.600703Z","times_seen":1,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":37,"dns":0,"connect":0,"send":0,"wait":53,"receive":1,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/EURUSD.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/EURUSD.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:52 GMT\r\nContent-Type: image/png\r\nContent-Length: 402350\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B4E173EA33304A0618\r\nAccept-Ranges: bytes\r\nETag: \"FBA1202A22AAC35FE14DCFE70EEA1A43\"\r\nLast-Modified: Fri, 19 Sep 2025 00:46:39 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 7769495217898757898\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: +6EgKiKqw1/hTc/nDuoaQw==\r\nx-oss-server-time: 23\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":402350,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 660 x 652, 8-bit/color RGBA, non-interlaced","md5":"fba1202a22aac35fe14dcfe70eea1a43","sha1":"a30645c212b954166d577562ba0f7dbd68db570a","sha256":"4ed1c8754089a32861767b14714acf215bcf7c75fbd6dd01be5c61818bbbcea5","sha512":"8dea5296c764c425fe183ae9a2a2c14a1d0e4a156a39548e3d8b920e4e6f278f4579e03c82cd191dce7d62cd106761a28addbf796c66c768b9b7ee1d1504d1a6","ssdeep":"12288:jB+QHHGPmn5mKrlYECc5WPN8H8HT9z/jSHAuVV5Jggc:j/GPtKrlDCc5iNyAwtdJgx","tlshash":"f68423c7948ae637238f7e3410e800495d356358aa0e566c8fc7c7ebe3337d5ea98529","first_seen":"2025-10-18T16:01:39.606665Z","last_seen":"2025-10-18T16:01:39.606665Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1594,"timings":{"blocked":849,"dns":0,"connect":0,"send":0,"wait":206,"receive":539,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/fonts/PINGFANG-SC-BOLD.b9f4c4ab.ttf","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.557Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /fonts/PINGFANG-SC-BOLD.b9f4c4ab.ttf HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/css/app.0b04c088.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 11139412\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\netag: \"68a73026-a9f954\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11139412,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 16 tables, 1st \"BASE\", name offset 0xa2b728","md5":"a5f40309207afeb657ed9436536d0d0c","sha1":"e08b67e9d2d1836268cdc905d4a7bc8aaf46d583","sha256":"b03430452ce3669613d60acaf8d799052aa1fdc03012feb481b5a27fe8a89fb8","sha512":"2a5d9eaeec304955d870d9e68b8efeb3a9ed268b1922a8750cc2fbc79b1eafbfde68f74b6dbddaae97950f0f722790d6a24ccda0c5e28ec0f5a7d252f9fd68f3","ssdeep":"24576:Jk3368WWqmO8+RYKjcpbR8z0AuxRbTn1tET64wBQFFlUqIY7NMIbvW:Jk336M5BI1E","tlshash":"36256d93c7c47d2d9b22fe3c6410f26ff48e5409892ad2f9cf632f36185656449a8eb1","first_seen":"2025-07-29T21:26:30.322215Z","last_seen":"2026-07-28T19:29:08.83963Z","times_seen":66,"resource_available":false,"data":null}},"time_used":8063,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1196,"receive":6867,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/axios/1.0.0/axios.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.113Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/axios/1.0.0/axios.min.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-32a9\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12969,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9720)","md5":"76235a7ee6b454034b80a390ccc92f37","sha1":"8a84e29a036660955f3ebc42d43bb522730b5707","sha256":"3c92bac09bac9bfd77f2ced65b63e009c9b67c109a9d37de637b3573d7ec7adb","sha512":"35c36d820651548001703c6458cfb922c55c12bd8c0ed73a8d095f0656e45c345e0f4fb2fe0e037d14009020dc38bed1e349d110b3f9f2f50dcfa0f05f8cbd08","ssdeep":"384:3ao8KGKMMT6nbNp0nkJFP5F0YS6DagzzNYT9eei:VGNp0EPb46DaT9e1","tlshash":"f242a7ce78a1b0d747f320f0905f5a0fb2b6992a644d84a0e560e8f66db546e8737f4c","first_seen":"2023-06-26T22:56:34Z","last_seen":"2026-07-30T19:42:39.812399Z","times_seen":334,"resource_available":true,"data":null}},"time_used":608,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":608,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getCoinList","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:45.770Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getCoinList HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1109,"timings":{"blocked":450,"dns":8,"connect":219,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uslc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uslc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"8c70c096af8ded082ff845ecacc2c06c","sha1":"36d3797d5a1cc603047ab293a7ea06406567ebfc","sha256":"fcaf7d9bda3517906494942bf3337a26aa4558de6ac788cda5d173b87d20b9cc","sha512":"ebeb88943b3e8bc5ec615111527a9ed3066d5ec1cd6fa66dcc7f2f0c5e8131fdbaab60c8e4b3b360dc4af71fbf76e5d02edbd36d68376c1d97642682b9c2a6e1","ssdeep":"","tlshash":"1f9002559c1c8242a8c304a5950a164504353160362593484c59612590885e36044858","first_seen":"2025-10-18T16:01:39.620274Z","last_seen":"2025-10-18T16:01:39.620274Z","times_seen":1,"resource_available":false,"data":null}},"time_used":379,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":379,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszw","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.155Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uszw HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1f9f0ff5fee01f13aa8e3f50fac7f459","sha1":"accade7e0899a3a2c1760380989fb3bbd8507cb8","sha256":"65b9c847513322f53cd89cd42a46b5f7c56576cf91923e1aacd656c780edff46","sha512":"8758001a4c5888e167fb5b18bb2623054bb81c651b003e25f5435bf378415df56b65d6346bd9d48441e116db01a76556608c1bf65eee2bfc9d8be28765d44601","ssdeep":"","tlshash":"179002555c1d8246a88301a5a61a360400283164262493484d59512680c81a22044859","first_seen":"2025-10-18T16:01:39.625059Z","last_seen":"2025-10-18T16:01:39.625059Z","times_seen":1,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/9/98/Palladium_1-noReflection.jpg/250px-Palladium_1-noReflection.jpg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 Aug 2025 07:58:25 GMT","end":"Fri, 14 Nov 2025 07:58:24 GMT"},"fingerprint":{"sha1":"00:6B:23:79:C6:3F:3F:33:1C:96:A8:58:E3:42:75:58:02:2B:84:D3","sha256":"AC:53:65:9E:C2:DF:AA:6F:9B:55:55:44:CF:4E:94:5A:41:C1:12:6D:4F:EA:F3:3D:EB:5E:40:17:00:3A:2E:26"}}},"request":{"raw":"GET /wikipedia/commons/thumb/9/98/Palladium_1-noReflection.jpg/250px-Palladium_1-noReflection.jpg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 06:01:00 GMT\r\netag: 028b22f847f6facd18145a0800675a2e\r\nserver: ATS/9.2.11\r\ncontent-type: image/jpeg\r\nx-object-meta-sha1base36: klf2k03jmvtots2lfsl9fs6vcceg3sv\r\ncontent-disposition: inline;filename*=UTF-8''Palladium_1-noReflection.jpg\r\nlast-modified: Fri, 19 Dec 2014 14:35:15 GMT\r\ncontent-length: 8218\r\nage: 35991\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 hit/25\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=_fsJiX6OQzG72jPAyRfWBAKQAAAAAFvdWD8kLK9_V2B37nNgJc-YdK-3YB8EfuWX;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 18 Oct 2026 00:00:00 GMT\r\nx-analytics: \r\nx-request-id: fdb2e03e-3e4c-414a-8bd5-af3ef3e578cd\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]}],"data":{"size":8218,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, comment: \"File source: http://commons.wikimedia.org/wiki/File:Palladium_1-noReflection.jpg\", baseline, precision 8, 250x205, components 3","md5":"028b22f847f6facd18145a0800675a2e","sha1":"b04f551f70ff206d1edcc1d8533ad0e41f36753f","sha256":"8ce79602bf8a88134bdf9090459fa95f88895facbe0dafb563728fcdb9021fad","sha512":"fca955f85de47d2968b0afac03d3d4431b3c8ec38527f3718a288348df3ec2155bc79ee1df7538ed50421ef73f7405ed5aa9d32f231e0ab93c4d69e366efa980","ssdeep":"192:nilm5csOrG8I4/6wIuNWF9947yZAts9I8h7jLM+Jk4dAJh6:niw5JLhJwI9zAW9VhbM+3GJh6","tlshash":"fc02af8db949a036c219f8f910b75b8e8390e5b23f11ae7f74c4535cd47e7ce4a14899","first_seen":"2025-10-18T16:01:39.513905Z","last_seen":"2025-10-18T16:01:39.513905Z","times_seen":1,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":25,"dns":2,"connect":19,"send":0,"wait":21,"receive":1,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/img/banner.81bde0f7.png","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /img/banner.81bde0f7.png HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-2196f\"\r\nexpires: Mon, 17 Nov 2025 16:00:52 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":137583,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1096 x 982, 8-bit colormap, non-interlaced","md5":"81bde0f76b8d8c587f93c31ca0118911","sha1":"d7696679f1f1278787cc6242af6a2e9a9af49ccd","sha256":"b3c59f9007ae88ab2eb802cf5b2f48e0c8fd71d96e02182af7975cf0ef29350d","sha512":"c7958c6ace2b3db1cea047c4373ff2722b43da16fc7993f748dc87d6f4ddfe0946f36c7cadd76ab9e25e7e4b316636d4a208dbb1f2623ead1441676336ca890f","ssdeep":"3072:o8xzSTATdbv2PiNXSQy48F60fv1h089EECVPYTUlki5rWx6M6vD:n8ATdD1SQy48gOv1hDCmUlFAx6MED","tlshash":"46d312d39adb5b94ce0788707341af093dae6a21fdea24514089da0f55ae3b48dc093f","first_seen":"2024-08-19T17:34:46.604947Z","last_seen":"2026-07-28T19:29:08.868379Z","times_seen":149,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uslc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.356Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uslc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"e4615ae9c876253e654eaa9b49e4b3c5","sha1":"987f93eec02a850c516ddac83090c75306664c48","sha256":"7991089e3f4a5b520d30029e7ebf46e72f06def595cf8268a94ca799e39219af","sha512":"18677fb17df29fec3283f8684b6fb70dbf3c5b918090e3fa7436a14a6ebd69e5ab8e1e85290d1dc260e9b0ddd8498565898f971013aaa28debf55b26e5877849","ssdeep":"","tlshash":"f79002555c1c8242a8c300a5950a164545283160362493484c59512590885a36084858","first_seen":"2025-10-18T16:01:39.636927Z","last_seen":"2025-10-18T16:01:39.636927Z","times_seen":1,"resource_available":false,"data":null}},"time_used":402,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":402,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/vue/2.6.10/vue.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.109Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/vue/2.6.10/vue.min.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-16deb\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93675,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65449)","md5":"17e942ea0854bd9dce2070bae6826937","sha1":"434cdec1669f2c6c7406297a72120936bc56ed52","sha256":"72194d152571dd375c4365e5c3b4af9db2c06af0102ced18fcb062597d38be26","sha512":"3f0439fa3817c71a6b34673cd32707137b29823e93b8389e1deff24e46c427e5396a897b753ba98bfe156f01c7ce54155bbed56f418b388b22622807802e6f72","ssdeep":"1536:1UXY7qLtpHt2Pqe1mZ8I6H82RaLiMBlo2VV2B/S/g:MYeJpN2yefjMBlPV00/g","tlshash":"529308dc7299b07157eb31f1107f140bf2365a19ac0ec194b222e4e67cb984d92abe7d","first_seen":"2023-03-07T01:18:07Z","last_seen":"2026-08-06T08:57:33.068236Z","times_seen":4442,"resource_available":true,"data":null}},"time_used":615,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":615,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getCoinList","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.455Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getCoinList HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31221,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ce9b7d9101609ea5cfeaa87dd9731d35","sha1":"8d4e37d1d54bac8fb7c666e6d6f227bc6ce7a3fc","sha256":"a904f02328ae5bd74893e069343f94bc22ad0b186b18f4144e995dcf4dd1bd7a","sha512":"3869a3c3bf1abfb88c75eef6c7528aadb2407a596e4b240ccb47bd9d45326b7060a92813dfea193ffaa4b3d845863211ecfbfde718b3ae6c37e6edc21fb36fa9","ssdeep":"384:iyPeoLkrxEMon/chV4OX1Z6cd3Nv99fMXfeCdsQ3Rhfax7U5ghV:x0T8j13a","tlshash":"1be2346a61a8857dd569c0e11ddf3e63e28d343fecc98b1ac3de485489e4ab1524bf03","first_seen":"2025-10-18T16:01:39.644154Z","last_seen":"2025-10-18T16:01:39.644154Z","times_seen":1,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/img/logo.ff96404c.svg","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.770Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /img/logo.ff96404c.svg HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Fri, 03 Oct 2025 02:26:45 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68df3465-27103\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":160003,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"97ba4aa724e4db77b016be0456cd7888","sha1":"859c6f7e5af23eb51ad7730154a3b59494fce92e","sha256":"5fdf0adc6a2068a4190e9468b7004f53f3bef4175d716078be4606e9914c5c22","sha512":"164df1eea944e77cc29f772412f0618b7650079c165c3bb7b2daa9bfa6afb5cc402c68b1dc7191d219be66edbbe62c3b995bff84b6763b1acccc16d035429be1","ssdeep":"3072:EAGsVR0evF1w3O1bow7V+DgLp6bfgBdatbg6ZEpBm6Bfng2bbT6:EAGsVRp1TRU096bfa16qpQm9bbW","tlshash":"58f3127071ca3dcff3688f88224f403c1d65da33b5694f5a865ca959023eb51db13eaa","first_seen":"2025-10-18T16:01:39.649062Z","last_seen":"2025-10-18T16:01:39.649062Z","times_seen":1,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.orientalkopi.asia/wp-content/uploads/2025/04/%E7%B2%BE%E9%80%89%E9%A9%AC%E6%9D%A5%E8%A5%BF%E4%BA%9A%E5%92%96%E5%95%A1%E5%93%81%E7%89%8C%E6%8E%A8%E8%8D%90%E6%8C%87%E5%8D%97-2.jpg","fqdn":"www.orientalkopi.asia","domain":"orientalkopi.asia","tld":"asia"},"ip":{"addr":"103.6.245.189","port":443,"asn":132198,"as":"iCore Technology Sdn Bhd","country":"Malaysia","country_code":"MY"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.orientalkopi.asia","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Oct 2025 23:21:14 GMT","end":"Mon, 12 Jan 2026 23:21:13 GMT"},"fingerprint":{"sha1":"44:86:3B:19:36:5B:31:7D:87:9B:ED:0F:35:60:0E:13:7B:86:36:9D","sha256":"09:D8:3B:0C:99:52:0F:62:7E:3F:08:8B:F8:D2:6D:1E:A0:6D:7B:90:F3:8E:33:4B:9B:B7:C1:55:11:B0:5B:0B"}}},"request":{"raw":"GET /wp-content/uploads/2025/04/%E7%B2%BE%E9%80%89%E9%A9%AC%E6%9D%A5%E8%A5%BF%E4%BA%9A%E5%92%96%E5%95%A1%E5%93%81%E7%89%8C%E6%8E%A8%E8%8D%90%E6%8C%87%E5%8D%97-2.jpg HTTP/1.1\r\nHost: www.orientalkopi.asia\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: public, max-age=10368000,public\r\nexpires: Sun, 15 Feb 2026 16:00:53 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Wed, 23 Apr 2025 08:51:06 GMT\r\naccept-ranges: bytes\r\ncontent-length: 772106\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\nserver: LiteSpeed\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":772106,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1093x1000, components 3","md5":"24b0bd47e7fc4d2d9a78f0c4ab82c9cc","sha1":"e5e43a3b5b721cf4acac26de55123c6a6a7949cf","sha256":"3d18d72ee727f132540b79a19d75670a5db39dbd44a2ef72b809e3462947f29a","sha512":"f2e6f690a0bdbb37bc6f2a7e30320b2519121dc1d9c9862117aa4f0a71bc9f022f60de564af267284123cc7d2a2802e8935716a3bdc41109c0e8ba1d53b6372e","ssdeep":"12288:tcGzl+CaoRU2ZSyyQjgCMwz0fBRoPZ8OtOmBigqRduFH5SwSRZUxUmmukDBFBqk8:GGB+DoR5gC7W7o/tBBigSOZSwSRGx9m6","tlshash":"e2f433ce43aa078fddd84bb09bc359198c55f86c425cca613ad1b5b6cec458cfaa448e","first_seen":"2025-10-18T16:01:39.653376Z","last_seen":"2025-10-18T16:01:39.653376Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2600,"timings":{"blocked":-1,"dns":818,"connect":205,"send":0,"wait":204,"receive":1063,"ssl":309},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xpdusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.346Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xpdusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91c23d9e27aaa94eb01e91897df9a59c","sha1":"5dcfe995809e277372a11e19dfed4e0683b36a74","sha256":"322594281b6e2f76cca3299a94038e72ce4166e5390be4c3fc3ec6a7d35e5d66","sha512":"0308c40c34f46d8ce27a3e7d55b89a50c4e0f48a88f71e87cb029d358adab805587c123ebd9b913b688fb269cf6774f0812abd0eb26e148a4232e4963206cd67","ssdeep":"","tlshash":"d29002956c1c8642a88300a59d0a1608002431a1262493485d59513580c82a32044858","first_seen":"2025-10-18T16:01:39.658062Z","last_seen":"2025-10-18T16:01:39.658062Z","times_seen":1,"resource_available":false,"data":null}},"time_used":414,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":414,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeni","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.387Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmeni HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"4cd5d92690bf0572bc654da8a3e45f38","sha1":"e53ecb2453801ad4133e87b96a10a8056e67c9cb","sha256":"7d11215496bba456c78e4f7501e0c92d7f91e8293785f1454095299147373481","sha512":"dadb703672a4c7927c18336fbe993b3203c095be803f755104d7c0aa4819f250be0b6448d4ff972103c35893f70f609399912775c31a3b1b7750360c703039de","ssdeep":"","tlshash":"a59002655c1c8242a88300a5952f5704442435602625a3484c59513580885b22044858","first_seen":"2025-10-18T16:01:39.662296Z","last_seen":"2025-10-18T16:01:39.662296Z","times_seen":1,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/css/views.3dd011a4.css","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:01:00.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /css/views.3dd011a4.css HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:01:00 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-798ee\"\r\nexpires: Sun, 19 Oct 2025 04:01:00 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":497902,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"4fdd43c387eb62a2d09e554396149bb6","sha1":"22f5a316a7de8a9156276a8dd38f60cb51a32acd","sha256":"7bbb0c5c9a62fb81cd96b899a8fd9df7eca561e4c4d2b2cba03b0807bbae8bc8","sha512":"d5a0efccd2400dbde5b83a043823b2dde7cbeea781cdafba4b8a036e73f2353be120fe7be2b9e6f0a85027be814ad3e6170d56c6f475ae907ca9525c35f64423","ssdeep":"12288:LWJxBhsAlTv+503BDmQMjzNlqB4LsOdn371ml69RZiQuOCXLRdd4sMZx+aby:ilTv+503BDml3bw4LsOdn371ml69Fwgy","tlshash":"b5b4a823732a2929b17bca3861c0779b3618e773c10352f9de91a829cbc7583376675d","first_seen":"2025-10-18T16:01:39.49306Z","last_seen":"2025-10-18T16:01:39.49306Z","times_seen":1,"resource_available":false,"data":null}},"time_used":416,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":416,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/css/chunk-vendors.b57e4bfb.css","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.101Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /css/chunk-vendors.b57e4bfb.css HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-49e\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1182,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (1182), with no line terminators","md5":"bfb572ddf961ce1e5d366017ddcf75dc","sha1":"5581fb5a4ba4645e0c7a08788b80c8f9adea0321","sha256":"10092d48c11ed6efd7474aa904ac1d89d6ad919b01efcc718fbb93715a92d87a","sha512":"f088f406fd3511782ff0fc2dbfba3d2adab4e676fafbba20235ffcb845b6bc275cbc08fa588251b3a317ec35a7d7c6d663b05531d89748bdcf6cb75af298795b","ssdeep":"","tlshash":"c221ab32cc900566a2276e07b6ce0a9a03aac602913bc1dd7f557519c386b6c1cdaf8b","first_seen":"2023-06-15T19:02:17Z","last_seen":"2026-07-30T19:42:39.863132Z","times_seen":314,"resource_available":false,"data":null}},"time_used":617,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":617,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/js/app.725f380b.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /js/app.725f380b.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 07 Oct 2025 17:03:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68e547d4-70c0f\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":461839,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65491), with no line terminators","md5":"359f21a2fb5f4c8b3918db68f7e9dc76","sha1":"83780632212b4d920456fb0e910f267fa30f142e","sha256":"b786b2c8394e52a68fef9cd3370a370d1deebb936e82d8634aa6a7c621bf421f","sha512":"f9892f6ca943bbd4a97ee5e9b822f515077afaae22413e7a97ba7a2ba677e74f23aa13ee7e3ba775b4a63f183328a8cafff20b17080dd6c16b2b2586403e3e4d","ssdeep":"6144:huHw1MQGRxORkC1sLmCSEH98oU202Ip8YXMiNEUvXEl+Miyh0C51ciHpSE/a:rXGRxsRsSy98uk6YX1glziyh0C5yESES","tlshash":"96b40a78a986d79829d13290385fa736b36c89d1bb8de40d9bb8c2c721df464f01b717","first_seen":"2025-10-18T16:01:39.669828Z","last_seen":"2025-10-18T16:01:39.669828Z","times_seen":1,"resource_available":false,"data":null}},"time_used":617,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":617,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/avue/2.9.5/avue.min.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.116Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/avue/2.9.5/avue.min.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-49541\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":300353,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (55624)","md5":"750459dc86246c289cdf5b760013f43b","sha1":"8103e042309fe4007cda921497f28410a75656ba","sha256":"5df0b88dacc1f9ae9edc0adc120da6190632e03cea789186cfc49d532918d6bf","sha512":"f9db639a43a21ca3a54d2546999e885bc0057f1b29eb9c2a1b7e5510dfd284530992a97c9642d4ed87357a472b7274b229279fdd45251ad9bc7c03564747375d","ssdeep":"3072:8mWzlkGK5sT4v9rD/2S4oqJNtvywiDjD7TefeKceKsT1/tF8vUoa:8mXqJNtvywiD37TefeKceKsT1/XBoa","tlshash":"50540959f1cab8750ad76070003f210af2372b896409d0a4b679d9e1adbce4da16ff7d","first_seen":"2025-03-06T09:16:43.423938Z","last_seen":"2026-07-30T19:42:39.885961Z","times_seen":249,"resource_available":true,"data":null}},"time_used":604,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":604,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/img/notice.33ac06bc.svg","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /img/notice.33ac06bc.svg HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-4e1\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1249,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"33ac06bca34d90bf8f54a5e7cf61705c","sha1":"e1e233886cca764953f4a00488feba786b30af2d","sha256":"a66dbdbf26594c37bf069bc460bbfc921ffaef7cbeb037cf9bdb6408bf9084ca","sha512":"7d9de9d7066d7ef131ddcaadbfdb9bed2bf1d0fe6221496fbb4a8ae0cdb9f1748f7c2952a33e29e7588ac1388712f28eed466f4da2a6304ea98c6e609c5cb50a","ssdeep":"","tlshash":"b8216288cf6c87b0b9990368c63049c27b4b20de9312437cc6306be0e156bb149505fd","first_seen":"2025-07-19T06:38:51.515858Z","last_seen":"2026-07-23T14:04:28.967184Z","times_seen":36,"resource_available":false,"data":null}},"time_used":589,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":589,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/5/5a/Oranges_and_orange_juice.jpg/250px-Oranges_and_orange_juice.jpg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.936Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 Aug 2025 07:58:25 GMT","end":"Fri, 14 Nov 2025 07:58:24 GMT"},"fingerprint":{"sha1":"00:6B:23:79:C6:3F:3F:33:1C:96:A8:58:E3:42:75:58:02:2B:84:D3","sha256":"AC:53:65:9E:C2:DF:AA:6F:9B:55:55:44:CF:4E:94:5A:41:C1:12:6D:4F:EA:F3:3D:EB:5E:40:17:00:3A:2E:26"}}},"request":{"raw":"GET /wikipedia/commons/thumb/5/5a/Oranges_and_orange_juice.jpg/250px-Oranges_and_orange_juice.jpg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 08:19:41 GMT\r\netag: 81445fbd9dac4d5539cfe6f9b25cf617\r\nserver: ATS/9.2.11\r\ncontent-type: image/jpeg\r\ncontent-disposition: inline;filename*=UTF-8''Oranges_and_orange_juice.jpg\r\nlast-modified: Wed, 24 Sep 2025 21:49:23 GMT\r\ncontent-length: 28979\r\nage: 27670\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 hit/15\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=KuXdQNR50CnHbvPg6n6PGQKQAAAAAFvdAo1U9sHewMf8WU3EZu1bDHd2zjsTxTbW;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 18 Oct 2026 00:00:00 GMT\r\nx-analytics: \r\nx-request-id: 3f196e1e-7004-47e1-ae75-1d2b7e293315\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]}],"data":{"size":28979,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 250x381, components 3","md5":"81445fbd9dac4d5539cfe6f9b25cf617","sha1":"0397102d3f0d8deefda30b89ab87d2f16fc5a1ac","sha256":"6a6d48794797441a5ffeb22a48735616b4e2055dc3f9585482ddfa57bc5c5fa4","sha512":"74da12a91cd3ddf5d248ef894a24a14090cf55c7be1d4264441ec27e80e053876fbfc41eb9088345babfc4455e2492e6fd6aba477aa07459f81aeea036ef5290","ssdeep":"768:i/A2X9O3qiGEI1EFu87JRaJ9XCg6qCxTFaErmGY:H2X9O7fs8cXCl3mGY","tlshash":"e6d2f1fe050507b0aaa4b8b591a93f2ff543f21857d91ca81ce7c2809cd518eba50fd1","first_seen":"2025-10-18T16:01:39.681962Z","last_seen":"2025-10-18T16:01:39.681962Z","times_seen":1,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":-1,"dns":0,"connect":23,"send":0,"wait":50,"receive":9,"ssl":43},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/USDJPY.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.002Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/USDJPY.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 310094\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B59D920A3036271BA1\r\nAccept-Ranges: bytes\r\nETag: \"20DD50836EFAA7879A0A2F42C27A9429\"\r\nLast-Modified: Fri, 19 Sep 2025 00:42:38 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 1672869156070279584\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: IN1Qg276p4eaCi9CwnqUKQ==\r\nx-oss-server-time: 17\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":310094,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 657 x 646, 8-bit/color RGBA, non-interlaced","md5":"20dd50836efaa7879a0a2f42c27a9429","sha1":"2cfaeb1a36945f5f30ca1a14c00c9bf9fe6e6a45","sha256":"6cf80f4604d8cddc72d48f9891f11db6da3784338128450eab4a48873d115958","sha512":"ab22437fabee35e1f96d63f3cb0b7c9a2f498ef472d25a86114cd99f628d7566e319caed4c16de5d409d73a59e447fae60aa49c152f15fa5554bf2b3123b2d11","ssdeep":"6144:yd64IU7KpggJHMHxx2S6GgO0GlhpGHNyuq+d/AMji75I:yU4IU7VgJHMHxx2SZgpGlKdqM/Lia","tlshash":"fd6423fd87149e33cd87b3aa13fd76dc3e1690849198f84fa10e298057a56e74c9a21b","first_seen":"2025-10-18T16:01:39.687075Z","last_seen":"2025-10-18T16:01:39.687075Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1684,"timings":{"blocked":1369,"dns":0,"connect":0,"send":0,"wait":205,"receive":110,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=72,f=webp/logo/1/binance-coin.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=72,f=webp/logo/1/binance-coin.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1120\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=yd5a3gfZ1lthqp7wr70DX2xAZkAV8vrOm1WE50B7vE3urIvrlDVGtvzQr4b6tchtCDYTY2IL%2Br7OobO9eBh2wEF6QvCKziKJdHDSkA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 99094044984e783d-OSL\r\ncf-cache-status: HIT\r\naccess-control-allow-origin: *\r\ncache-control: max-age=1209600\r\netag: \"cfntcTV644eBCXyqNx-fqnJLvIUIOyKwvJ4Ys7e8c_DQ:e78a379b68a54c667730191daf16c417\"\r\nlast-modified: Wed, 02 Oct 2024 06:33:27 GMT\r\nserver: cloudflare\r\nvary: Accept, accept-encoding\r\ncf-resized: internal=ok/h q=0 n=187+2 c=0+2 v=2025.10.8 l=1120 f=false c2=0 wv=2025.9.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1120,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3c233156c97ad4dd4e4fdceebf2dd8bc","sha1":"3e58651a8c2191162a708846f04ee1d4f8e294dd","sha256":"33affab8929f4b1a97e577880e0c301ff70171fab347ce223869822a29527f4c","sha512":"31abd129b6b6b478cf331cca1e194c391c8884c96e2c9cf4069ded9906fa9099974c782e444c3e2911775ea6cec1680dc0d8decc1710674fd1c50c5f203ae791","ssdeep":"","tlshash":"fa219609b728878fff7067784a477404b8e6a587e1805e1a100106a56ee351b95aaeb1","first_seen":"2025-10-11T06:36:30.446906Z","last_seen":"2025-11-15T10:35:16.092251Z","times_seen":3,"resource_available":false,"data":null}},"time_used":65,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xagusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.582Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=xagusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://jxauee.com/","date":"2025-10-18T16:00:43.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://jxauee.com/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:43 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 13 Oct 2025 00:20:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68ec45cf-fa4\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Vue.js:2.6.10","description":"Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.","website":"https://vuejs.org","common_platform_enumeration":"","icon":"vue.svg","categories":["JavaScript frameworks"]},{"name":"Axios:1.0.0","description":"Promise based HTTP client for the browser and node.js","website":"https://github.com/axios/axios","common_platform_enumeration":"","icon":"Axios.svg","categories":["JavaScript libraries"]}],"data":{"size":4004,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1208)","md5":"f433330307aac55ae18774197cf87158","sha1":"6be189e0a69826c66d046b549115d932cc707d10","sha256":"403d032631b592e510554878e3d45125a55a56c1ff1d1f98c7c8a72fffea46ba","sha512":"46afa14a30fcba551e9c6b254498db5bc89d989f56c05474ea6acb5e3637fad45d15a7681783ed57116ec820e9d77cbeb8187896829c31621dd9b442b78962c9","ssdeep":"","tlshash":"468176868d02855e25111da9eba7b10c01a5a40bee64dc24bcfc671c4f6dfcd49f2a9f","first_seen":"2025-10-18T16:01:39.696518Z","last_seen":"2025-10-18T16:01:39.696518Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1256,"timings":{"blocked":521,"dns":113,"connect":205,"send":0,"wait":205,"receive":0,"ssl":210},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeca","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmeca HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"112aaeeaef7db10ad6b506e7952170be","sha1":"d281a04530ebb28b192d7653c3b76876d99b1936","sha256":"e4504ed904f9704789e565757cb4a963bc114407f44379f88cb36684ca6839c9","sha512":"2e2785961f23be8b2d23d966df6867f63567865925828f16ad3a1a16cb17f6c87202cd19d4c86b8a730ec74df59d55c99f7ca7c5fe85d26230260344bcf7f7eb","ssdeep":"","tlshash":"2f9002655c1c8252a89300b9960e160411243160262493984c5a6225c0c81a22084858","first_seen":"2025-10-18T16:01:39.701481Z","last_seen":"2025-10-18T16:01:39.701481Z","times_seen":1,"resource_available":false,"data":null}},"time_used":380,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":379,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getAllSetting","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.998Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getAllSetting HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15015,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (14633), with no line terminators","md5":"a8cadfef78f80dea1980fdae1344cb74","sha1":"72c9016f156fdf7995eb7e5288002fadb282bfaa","sha256":"2712a2443fc17ff76a5febfb83b40e55e60b6dba5b7d01919a099b8810a78549","sha512":"05a25863713182208fdbb1143e445e6203121c31735a03b5529d8d301c82c1810a9a919e873a26ed6fc0c4a459622bbf4cb89c4634070364cb736a87109c7b89","ssdeep":"192:N0mlPfrd3rdzFFgljWPB6TyD+uJI+Rbuc2wJHGHiiiLLH3AvJoAU5bOGKz32se+Q:Ky3hpWlHUAT2CGMTLNBt/hifRf+o","tlshash":"b062861937d4ccbd56e71ed654bb2a56bbcc3477d198dc09e5e6ae0c888cab3480f10a","first_seen":"2025-10-18T16:01:39.273156Z","last_seen":"2025-10-18T16:01:39.273156Z","times_seen":1,"resource_available":false,"data":null}},"time_used":218,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":218,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=usoj","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.603Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=usoj HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=czcers","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.379Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=czcers HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"8731649d0d5faac08b321b54483ce837","sha1":"b52173da1abf1fcc8f57d678cec5bd328b4c04ef","sha256":"4a3080cd1b7b38e5002ab729bfd7062dd0f9406d9d7bef72947c38fb53299672","sha512":"33e4c3d5e9d08a26f1ff5caea40fbe7d14633ba010351b1c1baba6150750fde0896227559a9c25f25ad41787bd6bd4d37aa50f8f20ec608370a1e4841ea0e952","ssdeep":"","tlshash":"9a9002555c5c8242a88300b5990a1604002432602724a7484c59512590881a32044859","first_seen":"2025-10-18T16:01:39.706068Z","last_seen":"2025-10-18T16:01:39.706068Z","times_seen":1,"resource_available":false,"data":null}},"time_used":311,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":311,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uszc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.760Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uszc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":373,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":373,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/EURGBP.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.054Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/EURGBP.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 325574\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5E173EA33309D0818\r\nAccept-Ranges: bytes\r\nETag: \"A54C2D0C03AC1DB6CA36306B3BA2DA45\"\r\nLast-Modified: Thu, 18 Sep 2025 23:32:43 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 9672607562356965309\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: pUwtDAOsHbbKNjBrO6LaRQ==\r\nx-oss-server-time: 6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":325574,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 644 x 413, 8-bit/color RGBA, non-interlaced","md5":"a54c2d0c03ac1db6ca36306b3ba2da45","sha1":"d4b867c5bfee83f6e3c78b45ceff2cea8b446bf3","sha256":"14f9190597fe5401d80ebbcf886ff02b0abceb2d2537672da973c369b911dc23","sha512":"ebcbdf90126b78b42b25a0f90df7709d09a7efe921a04f858c2e8ed78e9bfc05a0115f8b13a6db1255f38d7665e15f290a8c4abfacae044222090de79011525f","ssdeep":"6144:X0VJ4TU5xPt8nyBntv6m+4MbPDMdZqp7lKBcSaWObPbjUJxinmt:XO/SKtmMDq2GSzi8XiM","tlshash":"d56423706337f54e360711f17bd7b2ab4de9d03ac3ca51aa4d91a92088fb8ea85c47d4","first_seen":"2025-10-18T16:01:39.711234Z","last_seen":"2025-10-18T16:01:39.711234Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1765,"timings":{"blocked":1494,"dns":0,"connect":0,"send":0,"wait":187,"receive":84,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=usoj","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.380Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=usoj HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"7be2c0685dd5b3c057833034040f50a0","sha1":"be591955d0ae4f0f5317226065668f6b0358144a","sha256":"6836ce9ea62980865da1c32af0bfa0db27550756dc561ab4b3fde0d2c842f0c8","sha512":"6ea95f94d9ff8b1077727bd1143257a0cf773ca4cca6595a8563b6f1f2702a45aa1fdeb225249c66e283aa041fadd3d6bbc5e173ffbf705275f565d5806ab4cc","ssdeep":"","tlshash":"aa9002565c1c8242a98304a9954a220500243160266592888c5dd126c0c85a62044c58","first_seen":"2025-10-18T16:01:39.715493Z","last_seen":"2025-10-18T16:01:39.715493Z","times_seen":1,"resource_available":false,"data":null}},"time_used":310,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":310,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/element-ui/2.15.6/index.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.115Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/element-ui/2.15.6/index.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-8f20d\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":586253,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65105), with no line terminators","md5":"693f98461ce3fa58cbe5ac24d9a21b1e","sha1":"93661cc05514da433809e79f229815ae1ddbee77","sha256":"24ebdea828e938d3a45128b41979b320b4cbd40c8c0d4bad6a9cd9bc3bfa4e0c","sha512":"2dab95b96bfccc9f78069504b006adc198531831c53c81b23b8d05163428f0a66beefe7d466452e7142cbe98419e36d327b20ab24dd3c25a05de9f9363e05d3e","ssdeep":"6144:B4lry61ETrc+kymEidUVM+u0kXzVXsnDBH7SuLH8isMZgS7Lu5:2U61Wrc+kymEiuVM+k9uVHOuD7Lu5","tlshash":"d3c41b8d72c1b5314ba36070503f250bb33b299c680980dcb679d8ea6dbd949526ffbd","first_seen":"2023-03-07T13:53:00Z","last_seen":"2026-08-02T04:27:23.770802Z","times_seen":561,"resource_available":true,"data":null}},"time_used":606,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":606,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/Platinum_crystals.jpg","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/Platinum_crystals.jpg HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:52 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 14956\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B4E173EA3330960518\r\nAccept-Ranges: bytes\r\nETag: \"CD60593609EBFDA0307D771A289F9337\"\r\nLast-Modified: Sun, 21 Sep 2025 01:51:24 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 9554670536425358207\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: zWBZNgnr/aAwfXcaKJ+TNw==\r\nx-oss-server-time: 6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":14956,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, baseline, precision 8, 250x175, components 3","md5":"cd60593609ebfda0307d771a289f9337","sha1":"a744b79bcb9de5042c3edef3b973aa95731da21f","sha256":"04b2e97ed79898df832f7a52f89ab682f1a302fc597befe1bb0416edda4e4c04","sha512":"693420b2a4a19dac3e605447a03e045340258c878458ef34083a4a871fbb7bb33eace82dda585687aed1b792c31ece662d7417130ff004b359190c0bf14c5e69","ssdeep":"384:ZWgHe0W4Fyy/Hpo5ZfzjEi1nWOBn50sce:xXVYy/HpwHTBue","tlshash":"4262cf603e389e6fce8225f9e6d23268c419fb7f11d586864e0468fc05a8fa06f52971","first_seen":"2025-10-18T16:01:39.722915Z","last_seen":"2025-10-18T16:01:39.722915Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1619,"timings":{"blocked":698,"dns":1,"connect":176,"send":0,"wait":185,"receive":1,"ssl":555},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/5/5d/Aluminium-4.jpg/250px-Aluminium-4.jpg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.927Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 Aug 2025 07:58:25 GMT","end":"Fri, 14 Nov 2025 07:58:24 GMT"},"fingerprint":{"sha1":"00:6B:23:79:C6:3F:3F:33:1C:96:A8:58:E3:42:75:58:02:2B:84:D3","sha256":"AC:53:65:9E:C2:DF:AA:6F:9B:55:55:44:CF:4E:94:5A:41:C1:12:6D:4F:EA:F3:3D:EB:5E:40:17:00:3A:2E:26"}}},"request":{"raw":"GET /wikipedia/commons/thumb/5/5d/Aluminium-4.jpg/250px-Aluminium-4.jpg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 05:13:20 GMT\r\netag: 008cd6452ef1f0666d5b6407e9618211\r\nserver: ATS/9.2.11\r\ncontent-type: image/jpeg\r\ncontent-disposition: inline;filename*=UTF-8''Aluminium-4.jpg\r\nlast-modified: Thu, 24 Oct 2024 12:42:54 GMT\r\ncontent-length: 20033\r\nage: 38851\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 hit/29\r\nx-cache-status: hit-front\r\nserver-timing: cache;desc=\"hit-front\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=rbatgLwYMoYSBWmo7eBpgAKQAAAAAFvdlig-fP7LYva7XyyskrwthbkUjX1_vjxq;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 18 Oct 2026 00:00:00 GMT\r\nx-analytics: \r\nx-request-id: ec14137d-389d-457d-92d0-f1ba9aa5c307\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Apache Traffic Server:9.2.11","description":"Apache Traffic Server is an open-source caching and proxying server that serves as an HTTP/1.1 and HTTP/2 reverse proxy with caching capabilities, load balancing, request routing, SSL termination, and support for advanced HTTP features.","website":"https://trafficserver.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*","icon":"Apache Traffic Server.svg","categories":["Web servers"]}],"data":{"size":20033,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=5, description=SONY DSC, xresolution=84, yresolution=92, resolutionunit=2], baseline, precision 8, 250x250, components 3","md5":"008cd6452ef1f0666d5b6407e9618211","sha1":"0d98345e22222142e1a1143db51c21be1e5c9c18","sha256":"d677f22038e348cb894c458c66c3ea9eb333cfc50bffe613a1466c3c7bd187e2","sha512":"fefd0e824726efb6671d42642fc81c00c92c063546278d8f19ecfb76be2e773520513f0b0d643af35dc2596c8d1085fa4fca067eebf0b92cf5174bf5f3f8b224","ssdeep":"384:x9hoAPDFyyXSYqYfC00X0piYOzl14q0+HvVCwRY1aen+wUgOwii6:bh5FT3qYfWXJYi14q7dDRY1mgA1","tlshash":"0892e10a3701911ab42b72fb03e399c8f6137d95a950af56c4298b5eeb57dc41243b42","first_seen":"2025-10-18T16:01:39.728078Z","last_seen":"2026-03-01T17:42:49.902822Z","times_seen":2,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":1,"connect":22,"send":0,"wait":40,"receive":7,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/USDCAD.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/USDCAD.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 290965\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5624592373581F31C\r\nAccept-Ranges: bytes\r\nETag: \"AB545C52B0E9571664F6A1FED9BFF55D\"\r\nLast-Modified: Fri, 19 Sep 2025 00:55:28 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 934316888571769280\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: q1RcUrDpVxZk9qH+2b/1XQ==\r\nx-oss-server-time: 25\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":290965,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 513 x 515, 8-bit/color RGBA, non-interlaced","md5":"ab545c52b0e9571664f6a1fed9bff55d","sha1":"dfe00af09f5eee1ec32c81ac57353ada783620ab","sha256":"79a4f31df156c78bd19e2b85bf99bbb29e080f6e7dae15743e6b16856c532822","sha512":"70a3ee496baa77de7f468f93639abf07cd27bb0e7b4267305ca6cdb2c4d8e547e3a2e97cb56ff591e619eb66a408b80fd756100a81e0fc18841e25531602da93","ssdeep":"6144:Lrais+JiMa/MnrtjK+H456qhfd2jRMjfQ690TvNKkK/OBr2:Lrav+J6ahK+ZqZUjRMUjTwkK/6C","tlshash":"3754232e14132128f7c6e9208be7b2c7e9c418cbe357900667658af2c4f75dc1ad9c97","first_seen":"2025-10-18T16:01:39.732679Z","last_seen":"2025-10-18T16:01:39.732679Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1747,"timings":{"blocked":1350,"dns":0,"connect":0,"send":0,"wait":210,"receive":187,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/fonts/PINGFANG-SC-HEAVY.1965ab7c.ttf","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.548Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /fonts/PINGFANG-SC-HEAVY.1965ab7c.ttf HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/css/app.0b04c088.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 11114788\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\netag: \"68a73026-a99924\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11114788,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 16 tables, 1st \"BASE\", name offset 0xa256ec","md5":"c11d4835ea9813d0e654d4c375257421","sha1":"44bdbe2b862dd5f236417788db8b286ebb2265af","sha256":"61a3b6d3ef3960a85ea310f8667b8615da678e9edea8b5036c8d9a09aea7169c","sha512":"1fe75b597c55aa2319b1d0efb5b02e4fd4b4e8a4772cf321100658f80957481254e68756b2e90f2cc7bdc0f585043659a10af097d18995037bd4e59917c18938","ssdeep":"24576:BkgBFPX1+oxFnjOPwVgsVDQezA7FEWXS5ltkCbudYqrj2wn0:BkkZC1q","tlshash":"07256dd3c7c87d299a21fd3c2510f66bf48e50088a25d2f9cf672f3618569744ea8eb1","first_seen":"2025-07-29T21:26:30.325138Z","last_seen":"2026-07-28T19:29:08.847456Z","times_seen":64,"resource_available":false,"data":null}},"time_used":4985,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":4780,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"echo-res.oss-cn-hongkong.aliyuncs.com/echo2.0ed68f6ddb2ae4f4bad26324135f723b5.png","fqdn":"echo-res.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.66.63","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.573Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.0ed68f6ddb2ae4f4bad26324135f723b5.png HTTP/1.1\r\nHost: echo-res.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 403 Forbidden\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 333\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5BC6A5B363015920F\r\nx-oss-ec: 0003-00000905\r\n\r\n","headers":null,"cookies":null,"status_code":"403","status_text":"Forbidden","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":2112,"timings":{"blocked":894,"dns":25,"connect":291,"send":0,"wait":291,"receive":0,"ssl":608},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/platform/dev/config.js?1760803245666","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:45.762Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /platform/dev/config.js?1760803245666 HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:45 GMT\r\ncontent-type: application/javascript\r\ncontent-length: 414\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\netag: \"68a73026-19e\"\r\nexpires: Sun, 19 Oct 2025 04:00:45 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":414,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"b1df0ef968f451d227a9e0666b06621b","sha1":"dd8feac07e320b94e5ad6e7185fc2cfb08001e32","sha256":"3affb631bc226680262ecc3072ea20c0fcdb84687b6f2cd3b5ae8e5c845fe9a1","sha512":"26cdb6d1e86af5f49f1f145473a6be8e6197297fe2135ab139b5130ebe55f36516dac80c352516aedd22d0beae2fe0183c1ac4949fe8207681cb6b781b36ab73","ssdeep":"","tlshash":"84e0a243f5b809833058afa0eca8887eb522022b026e3b2ca72528001faa028943852c","first_seen":"2025-10-18T16:01:39.742152Z","last_seen":"2025-10-18T16:01:39.742152Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1216,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"jxauee.com/","fqdn":"jxauee.com","domain":"jxauee.com","tld":"com"},"ip":{"addr":"109.104.154.97","port":443,"asn":136258,"as":"BrainStorm Network, Inc","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-18T16:00:42.199Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jxauee.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Sat, 27 Sep 2025 22:31:32 GMT","end":"Fri, 26 Dec 2025 22:31:31 GMT"},"fingerprint":{"sha1":"B0:5E:25:EE:D2:03:9B:2D:D4:16:86:4B:AD:7C:70:DF:83:C7:27:68","sha256":"B4:19:9C:66:61:9D:9B:E7:9F:2D:E8:AA:33:9D:81:47:09:81:78:D4:F4:A8:FD:7F:3D:9F:37:01:D4:61:3D:F9"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: jxauee.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 18 Oct 2025 16:00:43 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Sat, 11 Oct 2025 15:43:10 GMT\r\nVary: Accept-Encoding\r\nETag: W/\"68ea7b0e-f14\"\r\nContent-Encoding: gzip\r\nServer: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3860,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"c45ee306c29eeceb498a1a6d9aaee660","sha1":"e9c2223930f88b2d7402e766f4f92542b98c0f8c","sha256":"f637bd8c8314c9c5cc9ac6735a399bf41d4a01a2f5f13859b0325c54f17ea09a","sha512":"eab7318a2f4001c84f99f764d1ab09068c14a50030cabab11cc7c1cf39c0c2c8eacf82d5838286c6d9b1702b15a8ca5f69e0a232fcc1c0277189287a37c4a3d7","ssdeep":"","tlshash":"8881757b1cb74405401b50587be6b5083520102b3d49cca8bfee46a45fe1e5d5cb3afd","first_seen":"2025-10-18T16:01:39.748115Z","last_seen":"2025-10-18T16:01:39.748115Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1141,"timings":{"blocked":326,"dns":287,"connect":15,"send":0,"wait":490,"receive":0,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/js/chunk-vendors.d993d13c.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.105Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /js/chunk-vendors.d993d13c.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-c39c6\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":801222,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65454)","md5":"dd7518f743fb34d6e5d50a377217305d","sha1":"393aced7cd6f6e618ffa1a5ce32fb23637117b38","sha256":"8f0ddc26b65d6c1346d7e8f95ac87ef126b477a8764fee901bfc4e4a3090baef","sha512":"f3bf29c489e5eb325d83579c8fb9a596aa2c1a6778df5afc69904a9c7a398587b7cc219561b83e2b71eaff4cc7215ded38936afac059c8e91466d5a69c903b22","ssdeep":"12288:lzTsNvT06I+Qmvv00k/ylrh3uIgowOhppKD58aSQgpwXmPnX49:pTsNr5zlrh3uIgowOhppKD5gQt0q","tlshash":"9805f7cdf2c6b0a513e774a5003f650bf23a6818784e8995f265e4d5bcb898e513bf38","first_seen":"2025-10-18T16:01:39.752557Z","last_seen":"2025-10-18T16:01:39.752557Z","times_seen":1,"resource_available":true,"data":null}},"time_used":616,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":616,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeca","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.743Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmeca HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=dcec","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.759Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=dcec HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":375,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":375,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getCoinList","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.999Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getCoinList HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31221,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"1f1270297f524bf9ae32529578e06baf","sha1":"e6fca48ecddca2f1f367c4d409f6523c3dba9bdb","sha256":"72395111f4a42c5e5d32944c6f63a76ad86e5adac4061aa1a02fc9908d62d7da","sha512":"9493e67abbf2489750effc0be5296c18efc26d8e4fcda219e878336757d2ec2b8b7d89fc8e68ef605b159b87b6bed9b3ba316077a5a4105c33dee7e59da425d0","ssdeep":"384:i3QPHiIlGkeMWtYC0QVqEZh1D65TBEfNlzD9Lpqs1CCQaaQRFFCh2:IQaloQmIdF","tlshash":"82e2336a61a8857dd56580e11cef7e63e28d343fecc98b1bc3de484489e4ab5524bf03","first_seen":"2025-10-18T16:01:39.757447Z","last_seen":"2025-10-18T16:01:39.757447Z","times_seen":1,"resource_available":false,"data":null}},"time_used":425,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":425,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/USDCHF.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.005Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/USDCHF.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:52 GMT\r\nContent-Type: image/png\r\nContent-Length: 264685\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B4385D5B3434F5EA56\r\nAccept-Ranges: bytes\r\nETag: \"D13FA5695793DF5CB6940962A13FFE1F\"\r\nLast-Modified: Fri, 19 Sep 2025 00:53:37 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 11723114271875614124\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: 0T+laVeT31y2lAlioT/+Hw==\r\nx-oss-server-time: 20\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":264685,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 644 x 651, 8-bit/color RGBA, non-interlaced","md5":"d13fa5695793df5cb6940962a13ffe1f","sha1":"c8305d1255e008c01809357b611d54261588724a","sha256":"02a3e3e2558a0d94cce3cef7d1e3519606b7f9ef37c8523122288fdbd76b47b3","sha512":"72f21d7bb592a0fcf19bcb3cdd6d40270b8f9f986aa2b2f43aa25dc87c342e5fb3c962fbd8216a634a897652b71a91179d95baeda77af4bfc436a28213afa29d","ssdeep":"6144:VFQHx4H/6M6s1BqvEzctZs4sld1ZjKr6uMRzotOoOUGNl:ux4H/6MV8EsW3ZmrDOrNl","tlshash":"9b44237edd345a6cc2a316093aaf0d9f4f9e86af349f6cc99d4ddfb24c538908422164","first_seen":"2025-10-18T16:01:39.762643Z","last_seen":"2025-10-18T16:01:39.762643Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1252,"timings":{"blocked":-1,"dns":3,"connect":173,"send":0,"wait":196,"receive":412,"ssl":468},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/NZDUSD.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.036Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/NZDUSD.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 280428\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B57CC775313097C2C1\r\nAccept-Ranges: bytes\r\nETag: \"55C9ADA46510E216F4B2F43EE3916642\"\r\nLast-Modified: Thu, 18 Sep 2025 23:30:33 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 16348969412866854872\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: VcmtpGUQ4hb0svQ+45FmQg==\r\nx-oss-server-time: 23\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":280428,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 506 x 500, 8-bit/color RGBA, non-interlaced","md5":"55c9ada46510e216f4b2f43ee3916642","sha1":"3fc0b2bfb436e1241e74cc0b52a68c4efeb74b92","sha256":"f4a5917a62c94bff72d9bcf1f3f8968bac41d5201ce66ba61d5590f3fb93d742","sha512":"8e5f4d44adec6eaaae5f3b03d196801ac2feb8f79595f39ed0a83a64c530fa81abff4202cda09f9d59da7baf97e25d3626b8da13293c7af7e11e5ab3c7e1a65a","ssdeep":"6144:QisoBaelxzggamuRmWgg7XSjmr0qko2d3j/V4TCPxBYXotDgL:QisoBa05uRNg44qkVL2ExBM+W","tlshash":"f85423ac2d662a34851e59bf83a1e6d7455de41c2daec3dccb0f8748c3db0f1891b226","first_seen":"2025-10-18T16:01:39.767354Z","last_seen":"2025-10-18T16:01:39.767354Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1623,"timings":{"blocked":1372,"dns":0,"connect":0,"send":0,"wait":200,"receive":51,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=xptusd","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=xptusd HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"6d32d7eb6d07966f5ab62b9cc7af5a2a","sha1":"fd64ce83c4f225989cbc940ca4a9072fd5c47c86","sha256":"4af2a4a6ef9d3261daab7eeb95a9005cf1483d5b863720baa1c8c93582c68551","sha512":"22462b7fd63381aa0f9086c78d41fc5108b5c71e33bd86ba15205701e80b46fdfc6bedb07a977068a6dbe5d9be9e0d803eb390ff255647286f9525373f8bb4c3","ssdeep":"","tlshash":"4e9002555d1c8242e88300a5950e160400243170267593484c6a512580881a22044858","first_seen":"2025-10-18T16:01:39.772436Z","last_seen":"2025-10-18T16:01:39.772436Z","times_seen":1,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uslc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.746Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uslc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uskc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.754Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uskc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":377,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":377,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmesn","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.147Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmesn HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c6717727bc90ab933678579be40ae89f","sha1":"4697e664df8e5b02629c96d18b5d78c06cf1ba29","sha256":"5ac35ee5cb500c9b8435ed229b2e76d6fc6762f5dee241cb14166049aeffd683","sha512":"b8aa80c4ab2529b9c3ce65e30711c91a42628fd390625a8b0c5e598d78f4bdd60bd8f56206b29c663961a87008e91dbc2bde6a00a1a9f2284b333e1f7b8b7053","ssdeep":"","tlshash":"4b9002555c1c8252a88300a5950a1634007431a0262493488c595126c0882a22044858","first_seen":"2025-10-18T16:01:39.778186Z","last_seen":"2025-10-18T16:01:39.778186Z","times_seen":1,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/COMEXGC.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.815Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/COMEXGC.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:52 GMT\r\nContent-Type: image/png\r\nContent-Length: 613576\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B47CC7753130EEBFC1\r\nAccept-Ranges: bytes\r\nETag: \"A438B0A20A7C59DAD87432261B104462\"\r\nLast-Modified: Fri, 19 Sep 2025 00:31:04 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 4614290518833634497\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: pDiwogp8WdrYdDImGxBEYg==\r\nx-oss-server-time: 7\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":613576,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 643 x 633, 8-bit/color RGBA, non-interlaced","md5":"a438b0a20a7c59dad87432261b104462","sha1":"4d1686b59ea7ace9ff8ef09fdecb867786b85a61","sha256":"d67d60bc6df15533e51469f10f2173c805882d7e15ea3c6dea5a71901112a99f","sha512":"deb8722c7451f30274ea957bf7bcfc18d1a3b80e323fa72008b4c48d60193bc7b9b3daeefbe01ff6b266cd5c8b0033c1b852929c0d152e968a6c932b24b588d7","ssdeep":"12288:PJeianIxoxavIf1e9+rTDPG0fiYIL211jRX+nSQ5gVq6nT4cP:PkrIsavIfW+/D+YI6puSQPAP","tlshash":"b1d423db204f7b6842a0877f94af04e390779675c88a038cac47db6d506d1679fa8f6c","first_seen":"2025-10-18T16:01:39.782616Z","last_seen":"2025-10-18T16:01:39.782616Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2332,"timings":{"blocked":743,"dns":27,"connect":175,"send":0,"wait":183,"receive":663,"ssl":538},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"upload.wikimedia.org/wikipedia/commons/thumb/8/85/390_Triticum_vulgare_Vill.jpg/250px-390_Triticum_vulgare_Vill.jpg","fqdn":"upload.wikimedia.org","domain":"wikimedia.org","tld":"org"},"ip":{"addr":"185.15.59.240","port":443,"asn":14907,"as":"WIKIMEDIA","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.wikimedia.org","organization":""},"issuer":{"commonName":"E5","organization":"Let's Encrypt"},"validity":{"start":"Sat, 16 Aug 2025 07:58:25 GMT","end":"Fri, 14 Nov 2025 07:58:24 GMT"},"fingerprint":{"sha1":"00:6B:23:79:C6:3F:3F:33:1C:96:A8:58:E3:42:75:58:02:2B:84:D3","sha256":"AC:53:65:9E:C2:DF:AA:6F:9B:55:55:44:CF:4E:94:5A:41:C1:12:6D:4F:EA:F3:3D:EB:5E:40:17:00:3A:2E:26"}}},"request":{"raw":"GET /wikipedia/commons/thumb/8/85/390_Triticum_vulgare_Vill.jpg/250px-390_Triticum_vulgare_Vill.jpg HTTP/1.1\r\nHost: upload.wikimedia.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\nlast-modified: Mon, 28 Oct 2013 21:31:14 GMT\r\ncontent-length: 26629\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\nserver: envoy\r\netag: 4dbfdb912479543867a882438257c631\r\nage: 1\r\naccept-ranges: bytes\r\nx-cache: cp3076 hit, cp3076 miss\r\nx-cache-status: hit-local\r\nserver-timing: cache;desc=\"hit-local\", host;desc=\"cp3076\"\r\nstrict-transport-security: max-age=106384710; includeSubDomains; preload\r\nreport-to: { \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error\u0026schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }\r\nnel: { \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}\r\nx-client-ip: 91.90.42.154\r\nx-content-type-options: nosniff\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache\r\ntiming-allow-origin: *\r\nset-cookie: WMF-Uniq=JYuG7_s7kp5c3xxECJ9xmQKQAAAAAFvdsJK1HBOXeGNx4O1U8dGY2siGQM0VnVu-;Domain=upload.wikimedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 18 Oct 2026 00:00:00 GMT\r\nx-analytics: \r\nx-request-id: e782f31e-c265-4bf3-99be-1254054680a5\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Envoy","description":"Envoy is an open-source edge and service proxy, designed for cloud-native applications.","website":"https://www.envoyproxy.io/","common_platform_enumeration":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","icon":"Envoy.png","categories":["Reverse proxies"]}],"data":{"size":26629,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 200x200, segment length 16, baseline, precision 8, 250x374, components 3","md5":"4dbfdb912479543867a882438257c631","sha1":"74bc549bffadc5c340f55ef11ae6815235834ac6","sha256":"a19bd5b58e447c8caf8b6c73fe69c87c65a67491731ff29e91e59d04529a8d32","sha512":"b4b3b75db084fdbd5bea3a6bdcb746fca9170032377316f9c147c8fcdca242eef684f9da0926dc68fbdd80f0220cfdff5b403213bafb6a120dfdf77df6dabea9","ssdeep":"768:Tih00/r+yBNIdugFLI+3kBEB7GitNzSmVuYYT10ifUw:T+p6yvyWBEx3MMuZTp","tlshash":"98c2c08a79799687cdc6da330085759d137d29e682437ecd20e27c2867fdce8d158e09","first_seen":"2025-10-18T16:01:39.787559Z","last_seen":"2025-10-18T16:01:39.787559Z","times_seen":1,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":118,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/img/invest.369770fd.png","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /img/invest.369770fd.png HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:52 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-3999\"\r\nexpires: Mon, 17 Nov 2025 16:00:52 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14745,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"369770fd998825fe249bf196d63b01ff","sha1":"c67c1216f80688f0ec760fee4ad9bcfa4bd736c8","sha256":"8c7e97c30ca5277d666e690246b6ed8e72269501c49802a6e33caf2b8074dbad","sha512":"9bb55b0025e544d29dd3a03e38f56d0af2f8379dddd545b3e3979782ca1c5c4636873e34ede9ca7363565e752a707ae2e10c1c4a5333bc49d7e5f1c1e724de64","ssdeep":"384:dGJvXvgQHEEXyJUZOWhK+lQAOUaYrLPbK8jN7MlXp:dUX3kKZOW9Qh2NgZ","tlshash":"e262cf42b9506095b01accaa541ab6ed6ebb8b2cc67f62ffdd51060c2560873d34be6c","first_seen":"2025-03-18T04:06:10.351045Z","last_seen":"2026-07-28T19:29:08.865845Z","times_seen":32,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"echo-pro.oss-cn-hongkong.aliyuncs.com/echo2.0923f7542da6b4d91afe613facb8c7c32.png","fqdn":"echo-pro.oss-cn-hongkong.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.64.157","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.575Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"oss-cn-hongkong.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 07:02:09 GMT","end":"Sat, 21 Mar 2026 02:06:13 GMT"},"fingerprint":{"sha1":"B2:57:E9:B4:DF:20:94:4D:E2:85:59:20:BE:D8:5D:70:63:65:02:7A","sha256":"05:17:EA:27:D0:4C:D8:5D:6B:2C:A8:32:D5:A2:DD:E4:47:EC:4D:DC:E7:7B:33:67:F5:F7:4F:C1:73:01:01:19"}}},"request":{"raw":"GET /echo2.0923f7542da6b4d91afe613facb8c7c32.png HTTP/1.1\r\nHost: echo-pro.oss-cn-hongkong.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: application/xml\r\nContent-Length: 408\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5C78BAF37340BD213\r\nx-oss-server-time: 8\r\nx-oss-ec: 0026-00000001\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/xml","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":1111,"timings":{"blocked":-1,"dns":26,"connect":258,"send":0,"wait":266,"receive":0,"ssl":560},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeni","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.755Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmeni HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":378,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":378,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/AUDUSD.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/AUDUSD.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 308987\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5385D5B3434C8EC56\r\nAccept-Ranges: bytes\r\nETag: \"EAE56D6C09AF85B52C3B749B7DB85562\"\r\nLast-Modified: Fri, 19 Sep 2025 00:40:32 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 16253332344824804342\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: 6uVtbAmvhbUsO3SbfbhVYg==\r\nx-oss-server-time: 38\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":308987,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 657 x 647, 8-bit/color RGBA, non-interlaced","md5":"eae56d6c09af85b52c3b749b7db85562","sha1":"2d3fd8f4f065b928b5c9519328a64748ad704b70","sha256":"d2e85638f9e2da10d6a060c884ea09fa359b2161dbcf84f6a57b98d925d976a3","sha512":"5fa37d88e60b11ea6abb0642b7ba64466417471cf6ce70beb78d3b151647e45afd8cf7db884790f7152d4d785f5c74d8a0f3cd827092ec23be4c93f06a0f9184","ssdeep":"6144:PdvNnsIMiQrM504D08w/f0N1xfHr8SJOJYe8FSXI6CDPtSI1Ddv3Mq1k:Pd1snXw504rw0nxfr5BnFSXKTJd/u","tlshash":"5e6423a26b1408683993b3da8c70c9cdf6ba515b65e0e5d46003a39f6dd6d3a42f1fc3","first_seen":"2025-10-18T16:01:39.79837Z","last_seen":"2025-10-18T16:01:39.79837Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1574,"timings":{"blocked":1185,"dns":0,"connect":0,"send":0,"wait":223,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=nymexpa","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.592Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=nymexpa HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=nymexpa","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.351Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=nymexpa HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"65d4bfe851d59a8ad3f30a1a9e1fd7d0","sha1":"7970e3f9f19285b5cf72d5fdcaa3bd4e6b4a8d41","sha256":"ffd2ab18fed2b4e70ff8777e4cda9d4070afb8eff81846c2e7c769c3b961d594","sha512":"154a4874ee0fe39bb887313fed06ca3ec82f1d7d1d25bfcf5e67400d8423ff25b287b00c359ada484aaef4b51cc919312a7b896225cff10096972a8cc10a46e2","ssdeep":"","tlshash":"4c9002555c1c8252a88310a5990a160800243260262497484d59512980c81a22048c58","first_seen":"2025-10-18T16:01:39.803532Z","last_seen":"2025-10-18T16:01:39.803532Z","times_seen":1,"resource_available":false,"data":null}},"time_used":408,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":408,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeca","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.355Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmeca HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"91406409fa1c397b8b2c074fd4a4308d","sha1":"0b8694d362139cbd8a8b84581660bd503efbb9e6","sha256":"fb9974cc53a212da8df06ef1ea62ec41cfe001b3652b3f029492d9a65c47ac74","sha512":"30c4d2ee1020e7932b760458cc43e7ccfb2dd22d113c09574c434d0518235d160df591f404fad79011ba289343c3f13cbcb119005fce93913dd4b15757d212e4","ssdeep":"","tlshash":"309002655c1c8252a89340b9960a1604013431a0262493884c5a632580c81a22084858","first_seen":"2025-10-18T16:01:39.808274Z","last_seen":"2025-10-18T16:01:39.808274Z","times_seen":1,"resource_available":false,"data":null}},"time_used":403,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":403,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmepb","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmepb HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:46 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/img/lang.600feb8c.png","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.781Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /img/lang.600feb8c.png HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/png\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-1f25\"\r\nexpires: Mon, 17 Nov 2025 16:00:51 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7973,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced","md5":"600feb8c6e044b1ea251b112d8d09a8f","sha1":"eca24dee196a96b2bf3c4cc246a9409f13f853ac","sha256":"d08c13d2ccdf6da9d57bc7766c0a9d6739743bf2f611de96de0f1ec9f90733fb","sha512":"472a84b88e9c32d3a5dd7813970455f330c4b5b547e884536e0cd4099542e82350d4af20e488a408aaa49dc141945497044b3cc96de72bd22365b43e91b5559e","ssdeep":"192:jczx9qbHEefObcn9oRahcMoy582a00/9xgmBwKGs9LnoS:j7HEefEPMcJCg9x1bV5","tlshash":"0ff19ed01eb2f854212cb2fbf7cd27e02486d28574821277837f97692252b5f1b57049","first_seen":"2025-03-07T08:59:02.104427Z","last_seen":"2026-07-28T19:29:08.841329Z","times_seen":41,"resource_available":false,"data":null}},"time_used":608,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":608,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/USDCNH.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.220Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/USDCNH.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 185626\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B5E173EA3330900918\r\nAccept-Ranges: bytes\r\nETag: \"980F43CC273FB8732B0CB055B6373E89\"\r\nLast-Modified: Fri, 19 Sep 2025 00:59:19 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 1116214998539639357\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: mA9DzCc/uHMrDLBVtjc+iQ==\r\nx-oss-server-time: 24\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":185626,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 449 x 441, 8-bit/color RGBA, non-interlaced","md5":"980f43cc273fb8732b0cb055b6373e89","sha1":"b653b120ae378071d01a5dc853bb9f3bf1c54f54","sha256":"6552df1166842015c1747d10a6a3d83f55df42f07c093e3a01170ed64c5bedab","sha512":"7c8cc6f0683d1204906097c8628ed38f751178918cc21d30dbd9c3b85a1536fda67ff1ff546396b874e3e305b60102db2793d4698f284de35162c5d41158f08e","ssdeep":"3072:2CCdvxA4kG04QGW9/VR7nC1mtgvtXyAnFIMRxr208PN7IwWiB41WCSJ3//SV3S+q:2vq1Z9iXzi2yPN7I3WC2B/r+q","tlshash":"3c0412e0b48290d379e7aa812d71a0f419deb3f598892a01d3c8b5553e29c3523fb3f5","first_seen":"2025-10-18T16:01:39.823418Z","last_seen":"2025-10-18T16:01:39.823418Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1850,"timings":{"blocked":1599,"dns":0,"connect":0,"send":0,"wait":203,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uskc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=uskc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"170b0701f297aecdbc9028bcdc71f293","sha1":"5aec26877e6c3778c7a083aae168c9acf72f48d0","sha256":"b3b11446f6a55a7b5300bca53daf9ddc2d23e88b276d166af92d016d4342eca3","sha512":"55c580fa054e01a0f9de2395fa064b6fd939785ffde2b5a30d442e7b49173d90fbc27f8b0220efde7f80c5de215b09cdd4f7f3948ecf0b8b5b9a5a8435713cf3","ssdeep":"","tlshash":"b99002555c1c8342a88300b9950a5608042831752a2593485d59563590882b22044858","first_seen":"2025-10-18T16:01:39.829352Z","last_seen":"2025-10-18T16:01:39.829352Z","times_seen":1,"resource_available":false,"data":null}},"time_used":305,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/cdn/element-ui/2.15.6/theme-chalk/index.css","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.090Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /cdn/element-ui/2.15.6/theme-chalk/index.css HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-3a430\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":238640,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"2e0bf3411d54afa6402c0f114fc5a7cb","sha1":"0fcc1045629f8fa599d74eb33e44e5eb2406fd49","sha256":"c8df4deb1eaf507ea9e4c383d563c8f3bb6d35c0df018d5623a8e93d28df2a57","sha512":"4552f7d4f4119c1421778860f37fe49c27c28a0f77f957a9f176fab0001edb32e7b999a718e527087cf3a9c9c1c08d2e91daa01d357c2738fd48b606c47643a8","ssdeep":"1536:f28Y7SrW3YeWXA1u9w4HCe/l4Ttg5fqMEL0e/78OaiZkW1YO8eQFsGmtf0IcXyrc:k3H0Rkfeyl1hUEDw","tlshash":"0b34a7219b07216b612bde6db6c0ba895f18c323d4725bbbfe95740cc7d34891263a4f","first_seen":"2025-03-06T09:16:43.421068Z","last_seen":"2026-07-28T19:29:08.848462Z","times_seen":68,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/js/views.c11f0758.js","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:45.701Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /js/views.c11f0758.js HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:45 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-2dc105\"\r\nexpires: Sun, 19 Oct 2025 04:00:45 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2998533,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65464)","md5":"dea32c5e5c6ffcfe28ac74ec94a816ad","sha1":"349d47ee182e371a8d0ebc2f1e2b0639054a90d7","sha256":"5581e30276c116a06a86d414a7dc67233d8c8fed6df3dba31afe273b226e10a1","sha512":"daacb3588cf407684f07f6a62e339fd703dfa7e5d2ace53bc7e179c9dd8dfc7f3d4a42efdf383961bf51a8bbe3e7d81e6f155e1d28c6142bd1d3da11b1c8a381","ssdeep":"6144:Di5TBkGk/uuKsmUNcvMlJRPOiHt8OsCWHw8Ui3dAtThW3KV/OqJTcc6tIEelc7sz:DOWGqKsiYsiOOsdcuVamsKAT","tlshash":"d0251904b2a2b066c79e3564052f5009e279ba6c6407806df678d8f6bdf8d84772ef7c","first_seen":"2025-10-18T16:01:39.841186Z","last_seen":"2025-10-18T16:01:39.841186Z","times_seen":1,"resource_available":false,"data":null}},"time_used":255,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":255,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=czcers","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:47.141Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=czcers HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"703c421411d43fb5bac389003de2fe42","sha1":"7f3e8ba96a3184b6eff04e68108eef69aa9e18a9","sha256":"90b0dc146e04c50df448d3fb8c30df7b0f99fc90445b0f23aec14ee087e198b8","sha512":"0be653ca5a87228c54ff7646eb3d7fa9597eda61cf3bc85a43602603bc017e0419795a83bccb865f100bad19b9480838a4c0f0756965d661a7596e84852519f6","ssdeep":"","tlshash":"f69002555c1c8642a88300b5951a1a04103432603624d34c4c59512580881a2205485c","first_seen":"2025-10-18T16:01:39.847311Z","last_seen":"2025-10-18T16:01:39.847311Z","times_seen":1,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":208,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com/static/CNYUSD.png","fqdn":"sdfwewaef.oss-ap-southeast-1.aliyuncs.com","domain":"aliyuncs.com","tld":"com"},"ip":{"addr":"47.79.48.215","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:52.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ap-southeast-1.oss.aliyuncs.com","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 22 Jul 2025 08:21:21 GMT","end":"Sun, 23 Aug 2026 08:21:20 GMT"},"fingerprint":{"sha1":"B9:90:C9:A4:F9:5C:D9:49:DE:99:F9:50:6F:7C:79:A9:07:4D:8B:1C","sha256":"C7:2D:29:D0:BF:4B:5B:A3:1E:70:8C:EC:31:B7:94:9E:7A:9E:C8:DC:DA:3E:FD:82:74:D1:49:D0:5D:DC:01:2E"}}},"request":{"raw":"GET /static/CNYUSD.png HTTP/1.1\r\nHost: sdfwewaef.oss-ap-southeast-1.aliyuncs.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: AliyunOSS\r\nDate: Sat, 18 Oct 2025 16:00:53 GMT\r\nContent-Type: image/png\r\nContent-Length: 231090\r\nConnection: keep-alive\r\nx-oss-request-id: 68F3B9B541CA943934EAD9A1\r\nAccept-Ranges: bytes\r\nETag: \"39ABB97AA055ED7C03622BA057A66D77\"\r\nLast-Modified: Thu, 18 Sep 2025 23:39:14 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 4141385265425780163\r\nx-oss-storage-class: Standard\r\nx-oss-ec: 0048-00000113\r\nContent-Disposition: attachment\r\nx-oss-force-download: true\r\nContent-MD5: Oau5eqBV7XwDYiugV6Ztdw==\r\nx-oss-server-time: 14\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]}],"data":{"size":231090,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 670 x 338, 8-bit/color RGBA, non-interlaced","md5":"39abb97aa055ed7c03622ba057a66d77","sha1":"77056d6014ee8e4b4dfb29eec9985ca14c118d7d","sha256":"91b22d12940ccf41d10a1cd1f90c3e8d106d05bcfbe27ee498b8c124484d0d35","sha512":"31dd779883caa535d588f2313a6aed61360224eb9d1b96788535385692d41b820195a0cfec5acf90ec6cb33e969cdb2043cf8c0853ec703d26f523351c172131","ssdeep":"6144:B3AR/JrxG9+PwA7mAJpKrtD4q801Ke1/hy3:1AhJrxy+UADKr2q801j1s3","tlshash":"bd3423544a71f521bf42015599df4be9b8b62e4ac0c92da4c776e4828ff6fe0f53e202","first_seen":"2025-10-18T16:01:39.852044Z","last_seen":"2025-10-18T16:01:39.852044Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1843,"timings":{"blocked":1579,"dns":0,"connect":0,"send":0,"wait":194,"receive":70,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/notice/list?key=ROLL_NOTICE","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.001Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/notice/list?key=ROLL_NOTICE HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=uslc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.598Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=uslc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pc.atfx-iij.icu/css/app.0b04c088.css","fqdn":"pc.atfx-iij.icu","domain":"atfx-iij.icu","tld":"icu"},"ip":{"addr":"154.92.255.156","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:44.099Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"wap.mmkkll99.info","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Sep 2025 00:25:46 GMT","end":"Thu, 25 Dec 2025 00:25:45 GMT"},"fingerprint":{"sha1":"F0:EF:D9:D2:05:CE:3E:F7:D8:B8:AD:61:B2:B2:1B:EE:57:84:89:AA","sha256":"E8:E8:3E:63:2B:28:FC:84:41:29:8C:61:49:CB:80:3F:10:ED:EA:D9:EB:69:EC:D5:1B:4A:1D:18:84:EB:B4:25"}}},"request":{"raw":"GET /css/app.0b04c088.css HTTP/1.1\r\nHost: pc.atfx-iij.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:44 GMT\r\ncontent-type: text/css\r\nlast-modified: Thu, 21 Aug 2025 14:41:42 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68a73026-17e2f\"\r\nexpires: Sun, 19 Oct 2025 04:00:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":97839,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65528), with no line terminators","md5":"2e0bbc4ef9c2d6ee7163d03ed2d1e356","sha1":"aa2bedef5547b461159db3fde86548db20e7d235","sha256":"153b4f037b23a372a5a00d742b278211fb8ce708c495019a26432e714c5ff5b2","sha512":"905afa7b35cd352728d2544c4843663500a1b22ecdcbe17f10303778edac572ff6b3d6f64325d50bcf04e4a77b40559f5599f701cf3cfdb292f7e99a66f11c62","ssdeep":"1536:dm/4Tuu8IktP2dPUWlmABQNNP0vf6yrtayUz6J1jJvX:dfuu8IkYhuoAye6JtVX","tlshash":"aea34371d64a21e67367d55fab40b36a2375f33dd0412fb9f02b651d8ac228212d2f2e","first_seen":"2025-10-18T16:01:39.857248Z","last_seen":"2025-10-18T16:01:39.857248Z","times_seen":1,"resource_available":false,"data":null}},"time_used":617,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":617,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"pc.atfx-iij.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=comexgc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:46.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=comexgc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:47 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"48d4a782fa90e78a07c170449c749cac","sha1":"04a5e29ddcb2678d2449513828081c002ae8aeaf","sha256":"5485f9fd5903e83eeae58b0d935d959cdec7f61606e0f71c2f747545ec385253","sha512":"b8d2cca4a3ba4fc3f94f47786c8ec77f1d02b353eabdb76aaefc8e04d7ee8f7b0e6c25db87c9d2065cea6cf8e553c4543eec1bf2283c586dc53e4609be52e963","ssdeep":"","tlshash":"6a9002555c1c8642a8c304a5950a1604002436602624d3484c59512590c81a32144858","first_seen":"2025-10-18T16:01:39.863602Z","last_seen":"2025-10-18T16:01:39.863602Z","times_seen":1,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":212,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=comexgc","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.573Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=comexgc HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeah","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:53.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"OPTIONS /api/common/getMt5Amount?coin=lmeah HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: authorization,lang,language,satoken\r\nReferer: https://pc.atfx-iij.icu/\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\ncontent-length: 0\r\nvary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: authorization, lang, language, satoken\r\naccess-control-allow-credentials: true\r\naccess-control-max-age: 1800\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-06T11:49:18.179709Z","times_seen":17741993,"resource_available":true,"data":null}},"time_used":207,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webapi.44845.icu/api/common/getMt5Amount?coin=lmeah","fqdn":"webapi.44845.icu","domain":"44845.icu","tld":"icu"},"ip":{"addr":"154.92.255.154","port":443,"asn":984,"as":"OWS","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:54.354Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webapi.44845.icu","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Tue, 07 Oct 2025 16:02:29 GMT","end":"Mon, 05 Jan 2026 16:02:28 GMT"},"fingerprint":{"sha1":"E8:16:63:28:40:16:C2:36:35:DF:BB:8F:41:CB:F6:14:91:2A:9D:13","sha256":"CF:E7:98:E3:38:55:FC:D4:8F:62:D5:13:8C:3F:95:50:56:F1:7D:D7:10:90:64:4F:5F:C0:EE:49:F6:D8:1E:67"}}},"request":{"raw":"POST /api/common/getMt5Amount?coin=lmeah HTTP/1.1\r\nHost: webapi.44845.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nauthorization: undefined\r\nsatoken: undefined\r\nlang: en\r\nlanguage: en\r\nOrigin: https://pc.atfx-iij.icu\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 18 Oct 2025 16:00:54 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers\r\naccess-control-allow-origin: https://pc.atfx-iij.icu\r\naccess-control-allow-credentials: true\r\nx-content-type-options: nosniff\r\nx-xss-protection: 1; mode=block\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5638e878c6418299ff491fc9eb15f986","sha1":"e58f5e3f85e3a0e6e150e619f29585e1983d68c4","sha256":"a64b190e3977bd7bfdab40e2b0a616138538fdfa28e71afde80effb675ea5fc4","sha512":"2e0ffe02fa10613fc756bfc7d87dafce4d0fe689ac9474fd4f30be561577c967640571cd75fb2a509ecda72ee2e6dea5aa61e2cafe936600397479b2c41f8d3b","ssdeep":"","tlshash":"f19002565c1c8242a88304a9958a220400343160262592484c5d6125c0c85a62054c58","first_seen":"2025-10-18T16:01:39.871537Z","last_seen":"2025-10-18T16:01:39.871537Z","times_seen":1,"resource_available":false,"data":null}},"time_used":404,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":404,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-18","alert":"Sinkholed","trigger":"webapi.44845.icu","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s2.flink2.com/cdn-cgi/image/q=75,w=36,f=webp/logo/1/solana.png","fqdn":"s2.flink2.com","domain":"flink2.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.890Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"4c1db7df.sni.cloudflaressl.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 24 Sep 2025 02:21:50 GMT","end":"Tue, 23 Dec 2025 03:21:48 GMT"},"fingerprint":{"sha1":"F5:1A:1D:73:53:1F:C6:09:D8:A5:48:77:76:89:68:10:E6:52:46:5E","sha256":"89:43:C1:BE:97:4B:69:3E:81:29:01:A1:83:48:26:38:0F:9B:6F:EA:69:C6:08:4C:DD:9E:84:6B:95:C4:62:1F"}}},"request":{"raw":"GET /cdn-cgi/image/q=75,w=36,f=webp/logo/1/solana.png HTTP/1.1\r\nHost: s2.flink2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 18 Oct 2025 16:00:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 312\r\nserver: cloudflare\r\ncf-ray: 990940440ebb783d-OSL\r\ncf-cache-status: HIT\r\ncache-control: max-age=1209600\r\netag: \"cfX-2SO91cSm_-5v9VjBKESCQKlGH89erL6reLapjpDQ:48995a8cdd77daf01d2d04a889af1e0e\"\r\nlast-modified: Wed, 02 Oct 2024 13:47:23 GMT\r\nvary: Accept, Accept-Encoding\r\ncf-resized: internal=ok/h q=0 n=11+1 c=0+0 v=2025.10.9 l=312 f=false c2=0 wv=2025.10.0\r\ncontent-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:;\r\nx-content-type-options: nosniff\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=HFZGfiTABjGrxPejpEyoJNj9QB9e0PLjV36W86m7OELg%2B%2B5uKhNwuNmDE9g0tS261SOnuxoRLkAE53N%2B7hXTjhOkInbYv2YdQpn764hB5UrprN%2FhmzvM2Q%2BanXqXNW0%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nspeculation-rules: \"/cdn-cgi/speculation\"\r\naccess-control-allow-origin: *\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfL4;desc=\"?proto=TCP\u0026rtt=1306\u0026min_rtt=415\u0026rtt_var=1299\u0026sent=25\u0026recv=27\u0026lost=0\u0026retrans=0\u0026sent_bytes=9616\u0026recv_bytes=2675\u0026delivery_rate=11786046\u0026cwnd=257\u0026unsent_bytes=0\u0026cid=ff9123f94d9bc593\u0026ts=106\u0026x=0\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":312,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 36x36, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b7367ba1ab73800afb834e2c6f0394fb","sha1":"cac9859a92798e97aa709896dfc56208f60654a1","sha256":"aa8f32da58f7da91884f8231e285b2d49b07b58f9e370cc7bc1fcfe140b9c465","sha512":"71e470af119ee61ffb6cbd0d4d2d078b04903bdcd6fef24a2ab36152add99a415fa642a9b95da04e0c3b384a18dcb5feee0c87d40a1438942b1152156a15333a","ssdeep":"","tlshash":"cbe07dc674639381498234f7237dc55922844216e9eb598209f3129239282c2b196884","first_seen":"2025-10-18T16:01:39.876435Z","last_seen":"2025-10-18T16:01:39.876435Z","times_seen":1,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.da-meat.com/upfile/image/7f56336610f91ab844200ade83cdf7cd431b2287_b2.png","fqdn":"www.da-meat.com","domain":"da-meat.com","tld":"com"},"ip":{"addr":"35.201.164.148","port":443,"asn":396982,"as":"GOOGLE-CLOUD-PLATFORM","country":"Taiwan","country_code":"TW"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pc.atfx-iij.icu/","date":"2025-10-18T16:00:51.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.da-meat.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sat, 13 Sep 2025 18:07:22 GMT","end":"Fri, 12 Dec 2025 18:07:21 GMT"},"fingerprint":{"sha1":"0B:53:EA:8A:14:06:E6:DC:3F:4D:70:0A:99:49:72:FA:48:3B:9C:1B","sha256":"6F:3B:44:0F:60:75:20:FB:CB:DD:CB:F2:8F:B1:E7:86:25:5F:66:E1:3B:4D:04:A0:F0:9B:DC:4D:A1:3B:71:74"}}},"request":{"raw":"GET /upfile/image/7f56336610f91ab844200ade83cdf7cd431b2287_b2.png HTTP/1.1\r\nHost: www.da-meat.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://pc.atfx-iij.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nlast-modified: Mon, 20 Jun 2022 14:31:54 GMT\r\netag: \"a687d-5e1e1f7346e75\"\r\naccept-ranges: bytes\r\ncontent-length: 682109\r\ncache-control: max-age=290304000, public\r\ncontent-type: image/png\r\ndate: Sat, 18 Oct 2025 16:00:53 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":682109,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 820 x 410, 8-bit/color RGBA, non-interlaced","md5":"469f67c8460c382cc9d83c75042a074f","sha1":"47c27be95b28d0937aa581f408f76703f456a57b","sha256":"521c1f20692103ff89d575cdd238ec8baa5f838ae3e575b12994973fb7ccdcfd","sha512":"068575c9d629cd43a2a5e0727859f0a489a6393ae885b35c9f444d4d3cbac71ed64cd72e97e5eb7e1cd6fd24009ddb67d6701b78b2430d0ddccc791cdffd4ee1","ssdeep":"12288:TeJq8hka7dAnIclA+0PPwLzGzThBu2pcnhDHcQPgctpM2zJ1vNPvZ:Tpa7dAIM0guTfu2pchDFgctC2zN3Z","tlshash":"83e423c0827ff4b9e81f56177b7fca6502c8ba102eec7564469641c080acd9da617aff","first_seen":"2025-10-18T16:01:39.88065Z","last_seen":"2025-10-18T16:01:39.88065Z","times_seen":1,"resource_available":false,"data":null}},"time_used":3303,"timings":{"blocked":-1,"dns":1149,"connect":264,"send":0,"wait":267,"receive":1333,"ssl":290},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}