{"report_id":"6a9d5469-7767-4d06-98ba-c2f3510c3cd3","version":0,"status":"done","tags":[],"date":"2026-07-12T18:31:26Z","url":{"schema":"http","addr":"exehbiit.cfd/h5","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":0,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"exehbiit.cfd/h5/#/","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"title":"login","dom":{"size":427103,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (54591)","md5":"8c69041a7ab6bf0e18a50419532d21cb","sha1":"9f593034dfbdc1769c02129c3a070cbfda58b4a6","sha256":"d5c0266a20d247a003a5f4f47c1f2e9b646858d6a40acccf200a24cbc5a8c25c","sha512":"311f8cdf6fa73d2d7f63824f6495dab59b9e3ba699ed2000da9314b942a385a233f5d7f570f5d3f2d18c753f1c2e3f77eecd6c0b4c24a5d62da2cb29d7b0d34c","ssdeep":"6144:fkZdwG1ZAIkKDJ3bys5XrHeg05TMu8rr7fnFaGX7:8ZdwG1ZAIkKDJ3bys5XrHeg05Tyr3nJ","tlshash":"5094abd3f9c82008912bc656d68abb7db93faad243525cd7a70277218f526c7374821f","dom_hash":"domhash4dbe5d1c910b7abde122e8c44c8909a4","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"exehbiit.cfd/h5","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":0,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-16T18:31:26Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":5}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cdn.dcimg.net","ip":{"addr":"43.134.73.94","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"domain_registered":"2025-08-12","domain_rank":0,"first_seen":"2025-11-30T10:00:11.508826Z","last_seen":"2026-07-02T07:30:53.637433Z","alert_count":0,"request_count":1,"received_data":572,"sent_data":543,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"exehbiit.cfd","ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"domain_registered":"2026-03-31","domain_rank":0,"first_seen":"2026-07-10T08:43:38.291059Z","last_seen":"2026-07-10T08:43:38.291059Z","alert_count":95,"request_count":20,"received_data":1931745,"sent_data":10069,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/common/js/touch-emulator.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"0d154b6adddf5c3b55fc82ae644ee49c","sha1":"a95ea1b44e90808a4ab451d80c3b028382848344","sha256":"db389768f2124f004fc5bea1b8982b1cdb6effe28cf50a622ea882c0928d6470","sha512":"7b0313ad5ff1029fcba5be457fb44f84200fd3079a631fde5965a59666113d1da3f27c7077ab428e649afed4a3e8434504e5fbd45995c1d98c08fc9599fb4314","ssdeep":"192:uOhCaR57Uax9CyWJjpnwuly3bRZnGaRbnOPZuPZD1Cyknk/igoYIlO8:utVWTmPZGDfKgSO8","tlshash":"9732611f19e7136200ab332ab7cf5055f13ec0832505a115fcac6fa47f56b7986a92ce","size":11306,"data":"","first_seen":"2023-06-11T13:38:02Z","last_seen":"2026-07-12T18:31:34.523875Z","times_seen":149,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d6b954dc2d01b7f947ffbdbc08419c4","sha1":"91b4d1da374271f3f7a26ace5bb5d9a18cc7833d","sha256":"33452930b33391ee5b905f55ea3d83da98c22f96e001002468f1230369567e4e","sha512":"0edd93b88ed4f3b4e519ecaf80b84a9226198637f31e617f182614a579969c77e65863f98bda78349defd5054b0de9daff0d03b9299fdf432a72ca1b28191074","ssdeep":"","tlshash":"bb6000c3c03303000c0033ff00c300f00000c0000000f3003cc3000330000c003c00cc","size":16,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-12T18:31:34.536979Z","times_seen":971,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"c7c2044589cd6c4afb8f708d8f4929ce","sha1":"0a1a91f258a6b31b5f24008bde88fe949fd00317","sha256":"20217fc70ebe327eee12ece90b2c8ad0e6f760234c316849f05b7e2a7d0ee931","sha512":"50894a9f5d6c19842e74141d8b09cfc2ed951ee4d75dd45343c8c9156064fabc2129acf0c4635cfba00be760064af9293e826d7df958097177d67e364bb11248","ssdeep":"","tlshash":"25c04cb4761959305659a22d7239e7d83dbb501130437547901c158d0cf4e945671ea9","size":159,"data":"","first_seen":"2023-03-07T12:06:42Z","last_seen":"2026-07-12T18:31:34.540871Z","times_seen":1403,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"d9e35f3565e98641c0174d284e8ddd26","sha1":"967e8443ce108fe2742f3ec46237a40560c67c35","sha256":"6fc1c4ed09be48bc1d695bba608ad0c9ff9a525edd88b1819bdf413e88960e82","sha512":"7b6ca8aea3dd9c4b83fda1914179c9957606363ee546540bdaa87d0ed099362681da51036c06bb3a8c6641946b69621d72154075f78b02b770ab1bddb3ac8a23","ssdeep":"","tlshash":"576000000000f00c00c0000c003000c000c0f00f000c0c303c0fcc00300000c0f3000c","size":14,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-12T18:31:34.54165Z","times_seen":1524,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/index.e539567a.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"5735cf9a69970f701ddc02701d5ff8cc","sha1":"5b7f070ae176b9d3f9029812a5c6cb01c3f13fc9","sha256":"1b1cc8f0b4a665053b5dc90d3de31a0033db75fae5129a85d76419144b7c7ca9","sha512":"3b3f9fd0052f0caafa3c5eb7a280fb3959cf62d028a178252ab4b92d63a8d4d6dd4b66a959c49a9d063089f4f09ecf76aeee120e6eeb00217d9aed036bb7e312","ssdeep":"12288:8OnWL2AwQXhrBhTOfiEHonuEODS8D3MDc8wNutICUMSGAEdHDxbOExeTRwZdwG1O:nAyUbfeqZdwG1ZAIkKDJ3bys5XrHeg0H","tlshash":"3ef44987b4c1616852d31601919f32a863bedd362447b8e9f3c86a54dbd77cd2322b3b","size":730631,"data":"","first_seen":"2026-07-12T18:31:34.508418Z","last_seen":"2026-07-12T18:31:34.508418Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/pages-common-login.8372112b.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"27e267fe12a6ab43f8cd98dfa2a2f04f","sha1":"3f76866105ce52925d26e1d1cb1cdd04e333a640","sha256":"70e39edb83f361854519a387f5d71dca57c66acb70f4ec64e27e209401e51c04","sha512":"69bfc0a04ee1c800f8b80b5569def177869a6aca825081d4eb5168f7601aae2e1f08cb7203595e13f57e3a138ca73e3cc1ab3b6e72eeca9ef446603848405ba0","ssdeep":"768:UwWkIAU5zdeVQsJrOMVls6lRHMMsidpBzlshyn9pV:dB+z0VQsJrOos6lRHMMsidpPshE9f","tlshash":"26839ea2f5dc20164b67cb05bd49befede2baa2392016c72d851ef24ce166c7352071d","size":81219,"data":"","first_seen":"2026-07-12T18:31:34.502037Z","last_seen":"2026-07-12T18:31:34.502037Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/chunk-vendors.3f2a811d.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"cc48c5572ee299b855298fea0ff8adf9","sha1":"a86967edc2906448e845b555d4c621d1f7a5af7d","sha256":"efefd0df7aa1a5668ddc4a51d258a11012e7e17f2f2e57fb3e67917ab50ac9c9","sha512":"84b2be13bb2775b3d233e96327378562a78a955f792a575c0e94291bd7844f1836838228a4ae7656f36a15b3b7e7d17cedd43ff7abad094d3210ef8bd1b3f9e8","ssdeep":"6144:ncbC/lCGADdzbwyBL3dAhqFwaH2fy5J8pjyKmB9Y4sqnv3b8P:eCMBzUcaloJoj4jX3b+","tlshash":"9fe4089cb281b0ba07e761f5003f220ba13b6968b40ad4d5f279e5d4ad78d8e5127f7c","size":695952,"data":"","first_seen":"2025-12-05T18:13:14.558425Z","last_seen":"2026-07-12T18:31:34.486252Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-cont~13a38b3f.d51d2f32.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"c67c5f87abaae23bb3e3c151dce974cd","sha1":"0dbffbed947b92fdf3b1dd77c92a9f08b0146681","sha256":"d1d93f764349c1d4ebf3d12044a1961ee0b88c5ee474acd19de40e682bab8341","sha512":"8b823fa86b067a161a6b7cdb730747053497ffcf31345da342b455ec35d1c379733ee7cc9f3496b37e45454d96a0c5a30e0445ecc476b51128ce6cb6bd7fd6a6","ssdeep":"768:4KbYp9UgQnKb6QWm4AmCd0tG8e+W1MAbu7N8ChEAh8sd0Q2Z7wXR90tWNjZNztpt:4KbWWsYId0FHoMqu7NdEAaM2OBOpprDa","tlshash":"5cb3ccd2f6cc2840566fcf4e9341a3fcbbbaba2342697877e4622f244f772d62504558","size":109228,"data":"","first_seen":"2026-07-12T18:31:34.530007Z","last_seen":"2026-07-12T18:31:34.530007Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/pages-common-loan~pages-common-login~pages-common-register~pages-copytrade-copy~pages-follow-index~p~b6e13b3a.fa45b11d.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":false,"md5":"247533e8e718fdc79cb288d9c153fcbd","sha1":"a345574ba449690274cc7bb0792b6868ea81691a","sha256":"3fe343a675b51312bd2d6fb249f4616bf3047b468a8e469f9fbce914ac2293f9","sha512":"21161e807ae240b4da99f27bff146db651b74e86451eec9046766919fc72f48eaa817b2fe0e05f7d4f1ce6035b5fbde1953fe8fa227cced8526bad2084419ee1","ssdeep":"768:USz1EuVODNVEOXefR+SFxthjVvUghoX0lFJ2:Z2BNWbR+SWkT2","tlshash":"1cc36bdaf9c86004422bc716a54736fe9a7fefa30645acd6e9813f708e265d7270c49c","size":121718,"data":"","first_seen":"2026-07-12T18:31:34.498624Z","last_seen":"2026-07-12T18:31:34.498624Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cdn.dcimg.net/img/shadow-grey.png","fqdn":"cdn.dcimg.net","domain":"dcimg.net","tld":"net"},"ip":{"addr":"43.134.73.94","port":443,"asn":132203,"as":"Tencent Building, Kejizhongyi Avenue","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:31:01.543Z","timestamp":1783881061543,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcimg.net","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 12 Aug 2025 03:53:46 GMT","end":"Fri, 11 Sep 2026 03:53:45 GMT"},"fingerprint":{"sha1":"59:22:37:6F:C0:60:41:69:3B:75:92:CC:39:FF:78:E2:DA:0C:41:24","sha256":"52:2D:FE:EF:2F:19:40:C1:55:4F:33:A2:B9:D0:99:DC:0D:84:5F:89:A6:6E:35:A0:80:53:B2:DC:1A:3E:A1:C8"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcimg.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sun, 12 Jul 2026 18:31:03 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Sun, 12 Jul 2026 20:31:03 GMT\r\ncache-control: max-age=7200\r\nset-cookie: __uni__uid=rBYUBGpT3WeEY/MxAwfVAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcimg.net; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":572,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-07-13T06:52:47.348605Z","times_seen":17016,"resource_available":false,"data":null}},"time_used":2958,"timings":{"blocked":0,"dns":8,"connect":254,"send":0,"wait":254,"receive":1076,"ssl":1366},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T18:30:57.253Z","timestamp":1783881057253,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5 HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncontent-type: text/html\r\ndate: Sun, 12 Jul 2026 18:30:57 GMT\r\nlocation: http://exehbiit.cfd/h5/\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 162\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-13T07:17:51.133293Z","times_seen":17207279,"resource_available":true,"data":null}},"time_used":613,"timings":{"blocked":0,"dns":183,"connect":26,"send":0,"wait":337,"receive":0,"ssl":66},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/chunk-vendors.3f2a811d.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.284Z","timestamp":1783881058284,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/js/chunk-vendors.3f2a811d.js HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-cache: HIT, policy, disk\r\ndate: Thu, 09 Jul 2026 04:11:01 GMT\r\nlast-modified: Thu, 09 Jul 2026 04:11:02 GMT\r\nexpires: Thu, 09 Jul 2026 16:11:01 GMT\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\netag: W/\"698b6dad-a9e90\"\r\ncache-control: max-age=43200\r\nserver: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":695952,"size_decoded":220077,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65527), with no line terminators","md5":"cc48c5572ee299b855298fea0ff8adf9","sha1":"a86967edc2906448e845b555d4c621d1f7a5af7d","sha256":"efefd0df7aa1a5668ddc4a51d258a11012e7e17f2f2e57fb3e67917ab50ac9c9","sha512":"84b2be13bb2775b3d233e96327378562a78a955f792a575c0e94291bd7844f1836838228a4ae7656f36a15b3b7e7d17cedd43ff7abad094d3210ef8bd1b3f9e8","ssdeep":"6144:ncbC/lCGADdzbwyBL3dAhqFwaH2fy5J8pjyKmB9Y4sqnv3b8P:eCMBzUcaloJoj4jX3b+","tlshash":"9fe4089cb281b0ba07e761f5003f220ba13b6968b40ad4d5f279e5d4ad78d8e5127f7c","first_seen":"2025-12-05T18:13:14.558425Z","last_seen":"2026-07-12T18:31:34.486252Z","times_seen":2,"resource_available":true,"data":null}},"time_used":114,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":87,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/api/getSiteConfig?lang=en","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.680Z","timestamp":1783881058680,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /api/getSiteConfig?lang=en HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nset-cookie: angela_session=eyJpdiI6IlJVNFZiQkt4SWZBUGpwb0F4c3dyV2c9PSIsInZhbHVlIjoiM1k5VzNqdEptWFJBUDRpT0lxcDlvNXJuMUdBTkRNK3FPcENhMTQzbFVYVlpVWVVOT1hGelhKbG9uRDI1N0FKMW1sVGR6b1kxVVwvclZNSjdETkRMME5QWEFTQ25PbEdWbVpJNkFUclkwVkd5RnROeU5pSkk0OVhrUzRpdis4ajFNIiwibWFjIjoiZjFlOTIyNTFhMjNkZTdhY2ZmMmNhNTgwNDRjYmU2MjllMzU0NWE0MjgyNDQ5Y2Q1N2ZlOTViNGM2NjBhYWViYyJ9; expires=Sun, 12-Jul-2026 20:31:00 GMT; Max-Age=7200; path=/; httponly\r\nserver: nginx\r\nvary: Accept-Encoding\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncontent-encoding: gzip\r\ncontent-length: 103\r\ncontent-type: application/json\r\naccess-control-allow-origin: *\r\ncache-control: no-cache, private\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\nx-cache: BYPASS\r\ndate: Sun, 12 Jul 2026 18:31:00 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93,"size_decoded":911,"mime_type":"application/json","magic":"JSON text data","md5":"2bb419cd2d9f3d329ce6b93d108242cd","sha1":"3e0c8542b044613e46648617948021500867dea0","sha256":"b9177ebac15d50f143dcff9143f4240f7c65d2a2777ece7612687fdc2792ac46","sha512":"c6a16804cda8183d877ce836da23ccd5f254a91cb814277675706b963f06440bf2822a42b2cfa6c9bdd73bff9b4f5cc2ae3773fbd3147992b05a60e5e8fcb204","ssdeep":"","tlshash":"0db0124d000ccd340382c58215424005628e67c3c483070823d85cc48118b4d482216b","first_seen":"2026-07-12T18:31:34.490269Z","last_seen":"2026-07-12T18:31:34.490269Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1638,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1638,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://exehbiit.cfd/socket.io/?EIO=3\u0026transport=websocket","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.687Z","timestamp":1783881058687,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://exehbiit.cfd\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: ubh1wj6ZzY5X+Pcf8Rq43g==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nAlt-Svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nConnection: upgrade\r\nDate: Sun, 12 Jul 2026 18:30:59 GMT\r\nSec-Websocket-Accept: b5zzO5fGvwPvQuVtuBvek9ULDMI=\r\nSec-Websocket-Version: 13\r\nServer: nginx\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":265,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-13T07:17:51.133293Z","times_seen":17207279,"resource_available":true,"data":null}},"time_used":1083,"timings":{"blocked":-1,"dns":327,"connect":353,"send":0,"wait":340,"receive":27,"ssl":36},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/image/nav/nav-3.png","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.692Z","timestamp":1783881058692,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/image/nav/nav-3.png HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nx-cache: HIT, policy, disk\r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\ncache-control: max-age=2592000\r\nexpires: Sat, 08 Aug 2026 04:11:03 GMT\r\nvary: Accept-Encoding\r\netag: W/\"698b6dad-4d0\"\r\nlast-modified: Thu, 09 Jul 2026 04:11:03 GMT\r\ncontent-length: 772\r\nserver: nginx\r\ncontent-type: image/webp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":772,"size_decoded":1079,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"60d206ea2b7da7af256a950f6bbbc2a6","sha1":"b259e1de2717773e0e7e9aee3dab7b8e3e2ecd7b","sha256":"561561b7b99f768477669423c45e1dd62359b16be839cfea23f83acb04f8e665","sha512":"0853ac08c60ca086a0837a9cd23e4c5482129819169a2572e8bb898d1b153299869849312ec6c45bbd881cf0ce27301df0e3f7fd8a0c1359ed89b36e06105508","ssdeep":"","tlshash":"ff0125b89415e6cdcd46c8526cda27039347951545955fc30af9b05ac32e19c3a59494","first_seen":"2026-07-12T18:31:34.493257Z","last_seen":"2026-07-12T18:31:34.493257Z","times_seen":1,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/image/icon/home-bg.png","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.763Z","timestamp":1783881058763,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/image/icon/home-bg.png HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\nlast-modified: Thu, 09 Jul 2026 04:11:04 GMT\r\nx-cache: HIT, policy, disk\r\ncontent-type: image/webp\r\ncache-control: max-age=2592000\r\nserver: nginx\r\nvary: Accept-Encoding\r\nexpires: Sat, 08 Aug 2026 04:11:03 GMT\r\netag: W/\"698b6dad-2dabb\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17152,"size_decoded":17440,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f1ef9a558fa6dc51cca5288a72d56d4b","sha1":"edd2ba9361e2560d11bf243c3180f4646c733d79","sha256":"bb5aea20e659c585ff3e52864bfb66d16298585433666eec98306c21aef07e80","sha512":"d32261ad16924793c72754bd177341b4b8dcd667c2948801c6b7d9535df7f345036c8d51e75569ea241f7e50791178e45371757834298718cade86ceb84f8582","ssdeep":"384:DwcTZw69wI3D+VFdnQySi9MNrfB+bSgBEgvKJdZmBsP87fgp8n:lZBwISVPQyeF+OIvKJ9+OS","tlshash":"8f72cf22772af858323c748d668ec929aec2aab0fcbd54c561167c4bf772560d213b61","first_seen":"2026-07-12T18:31:34.495957Z","last_seen":"2026-07-12T18:31:34.495957Z","times_seen":1,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/pages-common-loan~pages-common-login~pages-common-register~pages-copytrade-copy~pages-follow-index~p~b6e13b3a.fa45b11d.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.663Z","timestamp":1783881058663,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/js/pages-common-loan~pages-common-login~pages-common-register~pages-copytrade-copy~pages-follow-index~p~b6e13b3a.fa45b11d.js HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Thu, 09 Jul 2026 04:11:03 GMT\r\nserver: nginx\r\ncontent-encoding: gzip\r\nx-cache: HIT, policy, disk\r\nvary: Accept-Encoding\r\ncache-control: max-age=43200\r\netag: W/\"698b6dad-1dc28\"\r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\nexpires: Thu, 09 Jul 2026 16:11:03 GMT\r\ncontent-type: application/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":121896,"size_decoded":18758,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65180), with no line terminators","md5":"247533e8e718fdc79cb288d9c153fcbd","sha1":"a345574ba449690274cc7bb0792b6868ea81691a","sha256":"3fe343a675b51312bd2d6fb249f4616bf3047b468a8e469f9fbce914ac2293f9","sha512":"21161e807ae240b4da99f27bff146db651b74e86451eec9046766919fc72f48eaa817b2fe0e05f7d4f1ce6035b5fbde1953fe8fa227cced8526bad2084419ee1","ssdeep":"768:USz1EuVODNVEOXefR+SFxthjVvUghoX0lFJ2:Z2BNWbR+SWkT2","tlshash":"1cc36bdaf9c86004422bc716a54736fe9a7fefa30645acd6e9813f708e265d7270c49c","first_seen":"2026-07-12T18:31:34.498624Z","last_seen":"2026-07-12T18:31:34.498624Z","times_seen":1,"resource_available":true,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/pages-common-login.8372112b.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.665Z","timestamp":1783881058665,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/js/pages-common-login.8372112b.js HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-encoding: gzip\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 09 Jul 2026 04:11:03 GMT\r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\nexpires: Thu, 09 Jul 2026 16:11:03 GMT\r\nx-cache: HIT, policy, disk\r\nserver: nginx\r\nvary: Accept-Encoding\r\ncache-control: max-age=43200\r\netag: W/\"698b6dad-13df5\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":81397,"size_decoded":21357,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65318), with no line terminators","md5":"27e267fe12a6ab43f8cd98dfa2a2f04f","sha1":"3f76866105ce52925d26e1d1cb1cdd04e333a640","sha256":"70e39edb83f361854519a387f5d71dca57c66acb70f4ec64e27e209401e51c04","sha512":"69bfc0a04ee1c800f8b80b5569def177869a6aca825081d4eb5168f7601aae2e1f08cb7203595e13f57e3a138ca73e3cc1ab3b6e72eeca9ef446603848405ba0","ssdeep":"768:UwWkIAU5zdeVQsJrOMVls6lRHMMsidpBzlshyn9pV:dB+z0VQsJrOos6lRHMMsidpPshE9f","tlshash":"26839ea2f5dc20164b67cb05bd49befede2baa2392016c72d851ef24ce166c7352071d","first_seen":"2026-07-12T18:31:34.502037Z","last_seen":"2026-07-12T18:31:34.502037Z","times_seen":1,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/image/icon/favicon.ico","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.938Z","timestamp":1783881058938,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/image/icon/favicon.ico HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-length: 150\r\nlast-modified: Thu, 09 Jul 2026 04:11:04 GMT\r\netag: \"698b71d2-403c7\"\r\naccept-ranges: bytes\r\nserver: nginx\r\ndate: Thu, 09 Jul 2026 04:11:04 GMT\r\ncontent-type: image/webp\r\nx-cache: HIT, policy, disk\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":150,"size_decoded":384,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 16x16, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"99ab0cb0f3854e2b84f0911f6943284e","sha1":"db594bca36d6d685e3bfa92a4e4ec474121c5d27","sha256":"f7f47a29bd1b264500338827ccc131c54ac95a6f31270421f2c3d1dcf0622afd","sha512":"15d1945b4db75efd01272e8c57d9afd5787445436005c456b44ed16879d4c5216d7a55bf1ec16dfc584a3ac890d9f33da53ce7efdb7037ab7ada55253ae99f4f","ssdeep":"","tlshash":"7cc08c16a2caa5124b23aae896ed0214cc3995424cc4cb11489763f083a2824a9011c9","first_seen":"2026-07-12T18:31:34.504818Z","last_seen":"2026-07-12T18:31:34.504818Z","times_seen":1,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/index.e539567a.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.288Z","timestamp":1783881058288,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/js/index.e539567a.js HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nvary: Accept-Encoding\r\ndate: Thu, 09 Jul 2026 04:11:01 GMT\r\nserver: nginx\r\nexpires: Thu, 09 Jul 2026 16:11:01 GMT\r\ncache-control: max-age=43200\r\nx-cache: HIT, policy, disk\r\nlast-modified: Thu, 09 Jul 2026 04:11:02 GMT\r\netag: W/\"69cb939d-b2607\"\r\ncontent-type: application/javascript\r\ncontent-encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":730631,"size_decoded":184056,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (61906), with no line terminators","md5":"5735cf9a69970f701ddc02701d5ff8cc","sha1":"5b7f070ae176b9d3f9029812a5c6cb01c3f13fc9","sha256":"1b1cc8f0b4a665053b5dc90d3de31a0033db75fae5129a85d76419144b7c7ca9","sha512":"3b3f9fd0052f0caafa3c5eb7a280fb3959cf62d028a178252ab4b92d63a8d4d6dd4b66a959c49a9d063089f4f09ecf76aeee120e6eeb00217d9aed036bb7e312","ssdeep":"12288:8OnWL2AwQXhrBhTOfiEHonuEODS8D3MDc8wNutICUMSGAEdHDxbOExeTRwZdwG1O:nAyUbfeqZdwG1ZAIkKDJ3bys5XrHeg0H","tlshash":"3ef44987b4c1616852d31601919f32a863bedd362447b8e9f3c86a54dbd77cd2322b3b","first_seen":"2026-07-12T18:31:34.508418Z","last_seen":"2026-07-12T18:31:34.508418Z","times_seen":1,"resource_available":true,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":81,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/DIN-Regular.ttf","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.677Z","timestamp":1783881058677,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/DIN-Regular.ttf HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\nx-cache: HIT, policy, disk\r\ncontent-type: application/octet-stream\r\ncontent-length: 24676\r\nlast-modified: Thu, 09 Jul 2026 04:11:03 GMT\r\netag: \"698b6dad-6064\"\r\naccept-ranges: bytes\r\nserver: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24676,"size_decoded":24925,"mime_type":"application/octet-stream","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 14 names, Macintosh","md5":"1e0b91dcb4ed262d0c603006919a1fd8","sha1":"aa0cecebc344f5a3bbd614ab97a42ff8f8637d46","sha256":"4749fb5068ba31c2cba31bf6c7340977fc21cf0e9339bdf155dd57457cfc9e0d","sha512":"dc5635a9a7a8f0b3b454de6c1cd56bd22d16310a18b874f153a38bdecaf41dad5eea2405f3e092d9040f9278d37cc5163dba32f3478f91d7a6a348f4ee708bd8","ssdeep":"384:9iJk3F9sakdL5E5P/y5QJ0FNpmuJqJgkJhBZ5JeJMz1vHJb90KILamCKwL/plOLz:9JmdlAn2/pm6cBpJX2sdX4","tlshash":"9db27c0957424b0fc7277e308e2642a2d725fcb427fa9bdb9d44d8f7606d2e34c68a45","first_seen":"2023-04-17T17:59:29Z","last_seen":"2026-07-12T18:31:34.511736Z","times_seen":524,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/image/nav/nav-1-active.png","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.690Z","timestamp":1783881058690,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/image/nav/nav-1-active.png HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Sat, 08 Aug 2026 04:11:03 GMT\r\netag: W/\"698b6dad-700\"\r\nx-cache: HIT, policy, disk\r\ncache-control: max-age=2592000\r\nserver: nginx\r\nlast-modified: Thu, 09 Jul 2026 04:11:03 GMT\r\ncontent-type: image/webp\r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\nvary: Accept-Encoding\r\ncontent-length: 328\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":328,"size_decoded":635,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"869f8895d164b32b46c504ea87caed22","sha1":"3ee8457b7263c9fea8d59141e4c52d015686e215","sha256":"469351d3a367f4b587c7f620c45127d6d3557ca7230167e84bd36ffc66148ba4","sha512":"7932efd027c011fb1c3daaaf8fe3884c24707775fe6b1fca81f4c571f04093ccd55081db114cfea6f10221cc459c2db9fb099226d1b4d7daf2afa3aa6eac89bf","ssdeep":"","tlshash":"0ae07daf46dee1d0efa4ec719809a5c0628566ce054279d215db2a635410aecb907d81","first_seen":"2026-07-12T18:31:34.512798Z","last_seen":"2026-07-12T18:31:34.512798Z","times_seen":1,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/image/nav/nav-5.png","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.695Z","timestamp":1783881058695,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/image/nav/nav-5.png HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Sat, 08 Aug 2026 04:11:03 GMT\r\nx-cache: HIT, policy, disk\r\ncontent-length: 478\r\netag: \"698b6dad-2fa\"\r\ncontent-type: image/webp\r\nlast-modified: Thu, 09 Jul 2026 04:11:03 GMT\r\ncache-control: max-age=2592000\r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\naccept-ranges: bytes\r\nserver: nginx\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":478,"size_decoded":782,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"de1350a58bbccfc0096eb311113950e3","sha1":"e45cf18212b93acf79d14f20c337ac101b842488","sha256":"4b5b34751e6e21d5201f455a38abe65a7d38247ba0448fbf44bd7c1e6ee6c826","sha512":"169d49e3c1eaaa972b683b58a191df8814b12413fbae575e262f38a8b6c4df66d424ef94bbc8241323eb98a16db264c4a649883bad17e1a7d1faa108070d92ca","ssdeep":"","tlshash":"0df0d45447151782d83d7c151a56bede24871c3841d7da63421eb50434d9a9f113a8da","first_seen":"2025-07-08T14:59:43.781799Z","last_seen":"2026-07-12T18:31:34.515103Z","times_seen":6,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/iconfont/iconfont.woff2","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.780Z","timestamp":1783881058780,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/iconfont/iconfont.woff2 HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\nserver: nginx\r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 32744\r\nlast-modified: Thu, 09 Jul 2026 04:11:04 GMT\r\nx-cache: HIT, policy, disk\r\netag: \"698b6dad-7fe8\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32744,"size_decoded":32979,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32744, version 1.0","md5":"5b8f35b173333c5161098c675e902401","sha1":"c33837d28eff55458d49ef00e68ae9a04da46f05","sha256":"912327f77b1b2d3092e0cda25efdd0c5045ef17d018864d1cefba33db7727fce","sha512":"38a8b9a82c69376f1664e4e76f31605a6ad31e611e2f282c46a40044624072a48ed8f9fd49735136afbd21ba61cc9ac9795828e6fcb33ad4b662bd41cf6b4084","ssdeep":"768:9P1NcXcebJOUlU8WQKAfiDvCcj+IWL3OJ:9dNcXceNOUSD3AfmCcfJ","tlshash":"cee2f1303175ab40c3e6ef396e7b1c46d8724a3892785ee1e3d16e4d142bccd19d5a2b","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-12T18:31:34.520315Z","times_seen":424,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-12T18:30:57.878Z","timestamp":1783881057878,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/ HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\ncontent-type: text/html\r\ndate: Sun, 12 Jul 2026 18:30:57 GMT\r\netag: \"698b6dad-3e2\"\r\nlast-modified: Tue, 10 Feb 2026 17:41:01 GMT\r\nserver: nginx\r\nx-cache: BYPASS\r\ncontent-length: 994\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":994,"size_decoded":1291,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (444)","md5":"182412fcd21b1a2f1615ff52f2eb51cf","sha1":"a66136619f75ec62e908441b0832541efee37c74","sha256":"4ea2dc47cd151c731357993c470f75f403f23a13cd1e2110a6f36b6aa451fd79","sha512":"0b92c38342616bfb3f953b348c57ca799096cc2bfa97ae53eb235b900d02a6e29b1391e161c93ea6decd105c8bed36ec89f649de4e16017a847e1eefe8c1ccfd","ssdeep":"","tlshash":"301144d75e00d5182721a95d78bdf35c88af86a62c61e802b8cc1c9d4fd4fc84f38854","first_seen":"2026-07-12T18:31:34.521539Z","last_seen":"2026-07-12T18:31:34.521539Z","times_seen":1,"resource_available":true,"data":null}},"time_used":184,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/common/js/touch-emulator.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.280Z","timestamp":1783881058280,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/common/js/touch-emulator.js HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\netag: W/\"698b6dad-2c2a\"\r\ncontent-encoding: gzip\r\nlast-modified: Thu, 09 Jul 2026 04:11:01 GMT\r\nvary: Accept-Encoding\r\nserver: nginx\r\ncontent-length: 3023\r\ndate: Thu, 09 Jul 2026 04:11:01 GMT\r\ncontent-type: application/javascript\r\nexpires: Thu, 09 Jul 2026 16:11:01 GMT\r\ncache-control: max-age=43200\r\nx-cache: HIT, policy, disk\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11306,"size_decoded":3366,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"0d154b6adddf5c3b55fc82ae644ee49c","sha1":"a95ea1b44e90808a4ab451d80c3b028382848344","sha256":"db389768f2124f004fc5bea1b8982b1cdb6effe28cf50a622ea882c0928d6470","sha512":"7b0313ad5ff1029fcba5be457fb44f84200fd3079a631fde5965a59666113d1da3f27c7077ab428e649afed4a3e8434504e5fbd45995c1d98c08fc9599fb4314","ssdeep":"192:uOhCaR57Uax9CyWJjpnwuly3bRZnGaRbnOPZuPZD1Cyknk/igoYIlO8:utVWTmPZGDfKgSO8","tlshash":"9732611f19e7136200ab332ab7cf5055f13ec0832505a115fcac6fa47f56b7986a92ce","first_seen":"2023-06-11T13:38:02Z","last_seen":"2026-07-12T18:31:34.523875Z","times_seen":149,"resource_available":true,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/index.css","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.282Z","timestamp":1783881058282,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/index.css HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nserver: nginx\r\ndate: Thu, 09 Jul 2026 04:11:01 GMT\r\ncontent-type: text/css\r\nexpires: Thu, 09 Jul 2026 16:11:01 GMT\r\ncache-control: max-age=43200\r\nx-cache: HIT, policy, disk\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\netag: W/\"698b6dad-17926\"\r\nlast-modified: Thu, 09 Jul 2026 04:11:01 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96550,"size_decoded":26799,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"fb26b917a0090bb6923ca9d41ac7d9c7","sha1":"9a3491569290c8b237e937a3ceb6b714a89d5bc6","sha256":"7c07cc6e4f9599272df61cc53ab4134e9db3b3fcccad3d7c2c8e0ce87221876c","sha512":"8879191f8faae33122c49a6ae0f877ee3c03cdb19f5b6760141764de59fd7aa50f2b48c117a0602922a5bc8283ed6986308703dbe0ed1df9936d4c620dc0b3c8","ssdeep":"1536:qlIApuK7hmVmz2RS1Wu3xdynGJ7eh/nrhlvb0:hApuK7hmVPS1Wu3iG41nrPg","tlshash":"d793f73719012e39e52bcd26b6c1ab5a1e60c133e15307adfba47628cbcf9c9167b345","first_seen":"2025-11-30T10:00:18.59949Z","last_seen":"2026-07-12T18:31:34.526961Z","times_seen":73,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":27,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-cont~13a38b3f.d51d2f32.js","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.660Z","timestamp":1783881058660,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-cont~13a38b3f.d51d2f32.js HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\nexpires: Thu, 09 Jul 2026 16:11:03 GMT\r\ncontent-encoding: gzip\r\nlast-modified: Thu, 09 Jul 2026 04:11:03 GMT\r\nx-cache: HIT, policy, disk\r\nserver: nginx\r\nvary: Accept-Encoding\r\netag: W/\"698b6dad-1aaac\"\r\ncontent-type: application/javascript\r\ncache-control: max-age=43200\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":109228,"size_decoded":38791,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65272), with no line terminators","md5":"c67c5f87abaae23bb3e3c151dce974cd","sha1":"0dbffbed947b92fdf3b1dd77c92a9f08b0146681","sha256":"d1d93f764349c1d4ebf3d12044a1961ee0b88c5ee474acd19de40e682bab8341","sha512":"8b823fa86b067a161a6b7cdb730747053497ffcf31345da342b455ec35d1c379733ee7cc9f3496b37e45454d96a0c5a30e0445ecc476b51128ce6cb6bd7fd6a6","ssdeep":"768:4KbYp9UgQnKb6QWm4AmCd0tG8e+W1MAbu7N8ChEAh8sd0Q2Z7wXR90tWNjZNztpt:4KbWWsYId0FHoMqu7NdEAaM2OBOpprDa","tlshash":"5cb3ccd2f6cc2840566fcf4e9341a3fcbbbaba2342697877e4622f244f772d62504558","first_seen":"2026-07-12T18:31:34.530007Z","last_seen":"2026-07-12T18:31:34.530007Z","times_seen":1,"resource_available":true,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/image/nav/nav-2.png","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.691Z","timestamp":1783881058691,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/image/nav/nav-2.png HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\nserver: nginx\r\ncache-control: max-age=2592000\r\ncontent-length: 258\r\nexpires: Sat, 08 Aug 2026 04:11:03 GMT\r\nx-cache: HIT, policy, disk\r\nlast-modified: Thu, 09 Jul 2026 17:00:56 GMT\r\ncontent-type: image/webp\r\netag: \"698b6dad-163\"\r\naccept-ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":258,"size_decoded":562,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cdc08013a52dff31d4097cc44962e1f1","sha1":"394a84a04706887e56566869f1abb8107cad980d","sha256":"daec4fa67922a808817647d32199a2c9e69b6c0669dc486ddd20a6e41f38a56c","sha512":"0d4d72bf34e46cd952eec0735d7721d59a68b5e734752e5b035025790e31aaad0c141a091e109cf5ffd833f1635e1b9e9dce00561aea606e00774cf5b053e868","ssdeep":"","tlshash":"05d02bad4299125dde0d3ca912b075c071db16980bb1b1831029482190ea98111a26e0","first_seen":"2025-01-23T11:50:03.881484Z","last_seen":"2026-07-12T18:31:34.532812Z","times_seen":7,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"exehbiit.cfd/h5/static/image/nav/nav-4.png","fqdn":"exehbiit.cfd","domain":"exehbiit.cfd","tld":"cfd"},"ip":{"addr":"38.60.211.102","port":443,"asn":138915,"as":"Kaopu Cloud HK Limited","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://exehbiit.cfd/h5/","date":"2026-07-12T18:30:58.694Z","timestamp":1783881058694,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"exehbiit.cfd","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 26 Jun 2026 15:21:13 GMT","end":"Thu, 24 Sep 2026 15:21:12 GMT"},"fingerprint":{"sha1":"57:38:EB:B1:11:74:86:97:FA:6D:6E:C2:9A:7C:D6:55:F3:E5:8A:49","sha256":"8F:13:1F:E3:E5:7B:96:39:F8:D8:A2:CC:BF:DD:55:4F:7F:B6:47:26:44:33:5F:6C:BA:E0:F2:C4:22:A0:08:E3"}}},"request":{"raw":"GET /h5/static/image/nav/nav-4.png HTTP/1.1\r\nHost: exehbiit.cfd\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://exehbiit.cfd/h5/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nlast-modified: Thu, 09 Jul 2026 17:00:14 GMT\r\netag: W/\"698b6dad-49b\"\r\nvary: Accept-Encoding\r\nserver: nginx\r\nexpires: Sat, 08 Aug 2026 04:11:03 GMT\r\ncache-control: max-age=2592000\r\nx-cache: HIT, policy, disk\r\ncontent-length: 732\r\ndate: Thu, 09 Jul 2026 04:11:03 GMT\r\ncontent-type: image/webp\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":732,"size_decoded":1039,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"250bedec194d67e5501e779590d637ac","sha1":"cce3362130f1120d29ddb63dd03c24ee308e630f","sha256":"690e25d10203846b68dced0283924ea8fe27f78a9f17c80d9c006c289ab00187","sha512":"df3917e09003eeebba8439c3092791d3ca5376a733767140dcfc5829b43145b53b10562606579213e259513b0049e5c4ed951d0b2895d150d478d42abfaeeb88","ssdeep":"","tlshash":"4801b5fcb21f51c4d6ce24bc40e74c930283606f88cbadc6452a02a82cfd6d19a369e9","first_seen":"2025-01-23T11:50:03.885151Z","last_seen":"2026-07-12T18:31:34.535048Z","times_seen":7,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-12","alert":"Phishing Block","trigger":"exehbiit.cfd","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-12","alert":"Sinkholed","trigger":"exehbiit.cfd","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}