{"report_id":"6af913ef-cf45-4bc8-9e09-fe002debddee","version":6,"status":"done","tags":[],"date":"2026-01-15T18:27:21Z","url":{"schema":"http","addr":"fanemail.icu/","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"fanemail.icu/#shop","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"title":"饭饭邮箱店铺","dom":{"size":36451,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (903)","md5":"8b0c455b0f3a3b59af0910d97e93a81d","sha1":"db73b2b93a84715b7e805fae4d951c6791a77eb7","sha256":"56d6adbbc54d3beec9bdee5bf2b9086f82450d15e01f6da974281b6c94e1f9cb","sha512":"a06e08d98f6a146b4075da393a4c9a30e4827f90cffc1c67ef2ca5f8ed7c31c91dfca7b869a5283a08ae7b4fb0b935842369ad59459d183d1b4783079a7498a9","ssdeep":"768:a8L6eFgvkLLuuNWY7e+Hawi5szo0/QjYc7Co:NnLLuuwae+HaZYo0/QjYc7Co","tlshash":"97f2942458f644370073e1c2f4a59b0a79c6d70bcb0b5d48b2fc8be15fcad659ca7a29","dom_hash":"domhash9e12960b290a764ee01d2fe4fe0f8c58","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"fanemail.icu/","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-19T18:27:21Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":1,"urlquery":0,"analyzer":1}},"detection":{"ids":[{"sensor_name":"suricata","title":"Suricata IDS","description":"Suricata /w Emerging Threats Pro","date":"2026-01-15T18:26:56Z","timestamp":1768501616,"ip_dst":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"ip_src":{"addr":"Client IP","port":58998,"asn":0,"as":"","country":"","country_code":"zz"},"severity":"medium","alert":"ET INFO Suspicious Domain (*.icu) in TLS SNI","source":"{\"timestamp\":\"2026-01-15T18:26:56.139142+0000\",\"flow_id\":1086719897171233,\"in_iface\":\"br-31613a7ed13b\",\"event_type\":\"alert\",\"src_ip\":\"172.18.0.20\",\"src_port\":58998,\"dest_ip\":\"172.67.140.56\",\"dest_port\":443,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2026889,\"rev\":4,\"signature\":\"ET INFO Suspicious Domain (*.icu) in TLS SNI\",\"category\":\"Potentially Bad Traffic\",\"severity\":2,\"metadata\":{\"attack_target\":[\"Client_Endpoint\"],\"confidence\":[\"High\"],\"created_at\":[\"2019_02_06\"],\"deployment\":[\"Perimeter\"],\"signature_severity\":[\"Informational\"],\"updated_at\":[\"2022_11_21\"]}},\"tls\":{\"sni\":\"fanemail.icu\",\"version\":\"TLS 1.3\",\"ja3\":{\"hash\":\"0faf2a91198d40dbd58b9308f3fca2fd\",\"string\":\"771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0\"},\"ja3s\":{\"hash\":\"eb1d94daa7e0344597e756a1fb6e7054\",\"string\":\"771,4865,51-43\"}},\"app_proto\":\"tls\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":5,\"bytes_toserver\":914,\"bytes_toclient\":3524,\"start\":\"2026-01-15T18:26:56.128289+0000\"}}"}],"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fanemail.icu","ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-10-20","domain_rank":0,"first_seen":"2025-09-11T14:57:47.244058Z","last_seen":"2025-09-11T14:57:47.244058Z","alert_count":35,"request_count":35,"received_data":4062249,"sent_data":16565,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"jQuery:2.1.3","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"OWL Carousel","description":"OWL Carousel is an enabled jQuery plugin that lets you create responsive carousel sliders.","website":"https://owlcarousel2.github.io/OwlCarousel2/","common_platform_enumeration":"","icon":"OWL Carousel.png","categories":["JavaScript libraries"]},{"name":"Magnific Popup","description":"Magnific Popup is a responsive lightbox \u0026 dialog script with focus on performance and providing best experience for user with any device.","website":"https://dimsemenov.com/plugins/magnific-popup/","common_platform_enumeration":"","icon":"Magnific Popup.png","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/modernizr.custom.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5213eb54ae903f0cc53d18c727f767d6","sha1":"4fc1139119ebd9b56add46c4156bd0c89687eaf2","sha256":"fd057b226661f22707982844727afd6cc5be630608ce7e1b1155d03edff45769","sha512":"f7e798a8109ed1fa193d941c8f01fd1a57a93b53a8a4a25f97d1c4806ea96a63b59bc3d445d4cf3126663d8d5868be9042ae1dc5c0e3c3cc0288bfd2688eab61","ssdeep":"192:plaZK8nnsnKdgPhQKQob1dHYPeIny6bkLDDhWwpy8b7z:naZK8ntdgPhQKQoZRY5y6iHh1pz","tlshash":"3612c6c97642f216879761b6907f420bf138d86ab8184c50e059d9fcb9708f8467bf2e","size":9358,"data":"","first_seen":"2023-08-26T13:04:31Z","last_seen":"2026-05-22T00:50:56.019692Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/animating.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"11387e44165d71f00407d6906c2acade","sha1":"79e43727a7604d887d74d589090a9b5438f40982","sha256":"49806f4423d116d289ff0730a45e1da10f76cc7af6ae2e90adad29705395e654","sha512":"3facb15fb788615d4963e206bc525e86841ba83fe3793c0510df15e6ddf40d97f459f2205c95023191c1255606567c9e640cbef6939a2dca105fc1a87eb40c16","ssdeep":"384:LyCbxxvxQEY2JSbgqBeDMXkWPWJW/WDrVV1t03:LZHvxQEY2JSbgqBeDMXkWPWJW/WDrVVS","tlshash":"d492287968233ca8471ba17b662f701049b128a3933c8f78797dc5096fa2c51d16b9fe","size":19922,"data":"","first_seen":"2025-09-11T14:57:52.791281Z","last_seen":"2026-01-15T18:27:25.083006Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/perfect-scrollbar.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"a85bd83466acc018be87dcf8a9175892","sha1":"85bf4c744111b36095cc3afa56857c80473a218b","sha256":"5746f9b41e4ce17a55368c6e241c422b1dacd8f6b0652b6472b0e9216b23a300","sha512":"8c549f5e9d77dff2d6231dffab34fee73d693a28fbdfb1d6c1577fc86557d195535052f2f3cea658f2c3b064a2aa8ac86d724edd4800799c67e00cad226c7495","ssdeep":"384:RCQfouNtwIA7zcaxo3kfZmUF6UF1xtjhUlA4JWk4h8tCCQ9gQZQiQqWQuQsjupWA:RC1uNtwIxA4JrS3oLTK","tlshash":"11b2944cb21070a082ff315dc1db8b0e72725453b74fa5d0a490dfb8a9787ba2356b6e","size":24719,"data":"","first_seen":"2023-03-07T01:02:56Z","last_seen":"2026-05-23T17:16:38.003327Z","times_seen":795,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"f45040c72ce0140bf0c61e86f3e52bb5","sha1":"644693c4bf01e7a8afc4488b685caf75dbae3530","sha256":"c02b7b3b35d7a0986eb47202d7342b4af49bdd45b09fceb2f008e64d6729772c","sha512":"97a08e9bb22090f7a8ae220d5b27b57b8655039d48bb39d39c694c9ccffd3ea48e50edadc33549420efda5132214c44ce72c777dbedb768816d1f22ecf9a2c28","ssdeep":"","tlshash":"3790021010629541f052205c5637135010326a633844c1ae761f82009f010c7c7360c8","size":57,"data":"","first_seen":"2025-09-11T14:57:52.825116Z","last_seen":"2026-01-15T18:27:25.114667Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/jquery.shuffle.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6bbd7d1cdc7142d8b48687650a49510a","sha1":"b3ea6678dda3726adb08a4f61fb41c4c1b83d51d","sha256":"59ae6e57567a00b332a40e47ce2800a5f6792c0b6525ce4e354406f413ef7dc9","sha512":"039091ef5788237be2dbf5632c45990837bb1f3836935eaaf50dc0974d9c55b168d3a187ade5fa6d91304b1e7f5204b46c58eb810e6fee797b836e8db690fb9f","ssdeep":"192:xk25CBW2Por27/PePg0KWGAKRcbW8Wwakq4pmqbrSRbiuVBKuGdBLAMqhn:WqCAWdWGAKAWZymqb+Liz0x","tlshash":"c15261c7799035659353e5a121ff010f223e58adbf4548bc78a8c8e96a7a84c3933f78","size":14462,"data":"","first_seen":"2023-03-07T13:02:02Z","last_seen":"2026-05-22T00:50:56.033459Z","times_seen":107,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/static/layer/layer.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c07601c9dc7a051f684ada8b5a588c1e","sha1":"10b905cb285468743b548c66ec0a54f7204ed392","sha256":"96f235f5991ceb8e21a80d7090eced3d3792b451b52e3614713a07e23d1d563c","sha512":"d14baec3781b4ad8aa2b284184d7d02be413ca75df4ec69f3274f1acaa1dc71dc51f552a5e0d8dc74ae0f4326031512a11bd53bf90a6fd869493f78ba7810ea7","ssdeep":"384:B13Cih5R93iKTtXSt/KrGriu46K+Lxz6PTElH0jlhpPtwo:B1Siz3i0QtvTKiFSb2o","tlshash":"72a2c76a755034976323906ad10f7a0b31b21d24d7078128f22bb4be1dbcd99a2b7f5f","size":22724,"data":"","first_seen":"2023-04-07T18:53:04Z","last_seen":"2026-05-23T14:51:30.804389Z","times_seen":11184,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/static/clipboard.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"440d9349a6bc8eb0fb35317588148985","sha1":"1f4b462a38a5657298ef2e8ac8c98f4060178bbd","sha256":"4979e7fea71c2707c8078550d5d03bbe69bfce3b415e7ce4faec7ada9d3a358a","sha512":"554c4da3331dd8ac186d935f5c4bc256ee0f9060705c6c4aac29b3427c05f4cedba03978e24794a42d5954b4d50db9804c8ebe4da691e9c0d09cd17ee1bbbbba","ssdeep":"192:N2TojWHQ4LygI+GlfHQ4LyQB3153pPN7rnoWtBTwuLJvqo5kAssU:Nrjsc+GLfB33JhoWtBT9LJSo9U","tlshash":"be229668b280b1b18ae770a9413f424bf3729469709a90d4b239d8f1adb8dcd5467f3d","size":10752,"data":"","first_seen":"2023-04-07T12:42:17Z","last_seen":"2026-05-22T13:11:38.172501Z","times_seen":263,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"d514fec6d843a35776152886ce9f9dc3","sha1":"daa868a2d04e72c39a2fec3a7e0364d9586c3ff6","sha256":"dd3529bfb4bb0e1a704ec1db476b53b0d66df0c3c727b408ecfd49d335f4cec4","sha512":"0bd8b7f3d739bd5d8ca2467bc2842a2225ff0de72704a58b368943fe920d05ba5f9cb0b1f0cf4bd882479054467f1df2dfba9c39ced3173ea72656cbfaca4146","ssdeep":"","tlshash":"ffb0021c365610c5452212c5066f4c9468c4e8073301c4d8760d47c1bf02c50d05b9ff","size":94,"data":"","first_seen":"2025-12-25T03:56:29.857516Z","last_seen":"2026-05-20T13:33:59.804698Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/static/acg.js?v=3.1.0","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"77ba48c2172e2f285ca8020f9e02894f","sha1":"f13c2ef6a85a2bd8fdb1c65626db6270b2e20c71","sha256":"c152d473880b931609ea9fa469c21affbe61b03e2af7246d3ef609e20a1335aa","sha512":"c6e927a862ab587e16628369c391618a3c6f2080b542e9ee69c29f4dbadd92c72fd601125d89f8799807ae9eb04957e25cdb1592e1b64fd51b148614a8bc975b","ssdeep":"768:k+j5YCOtFnD/uedTD1Rjs21kJiEsghjTYzNZwxIMpJF/pQpno2l2syL/qNz8oGe/:k+y3qxi9lxLKd4","tlshash":"b5037f1c27f715114a33b0782b9f60047a69811ba258ee08be5d97d06fc883967f6ff9","size":39111,"data":"","first_seen":"2023-06-02T00:24:04Z","last_seen":"2026-05-10T03:21:32.369786Z","times_seen":14,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"92f927e4ae8e07cbb1241347bd9c81cd","sha1":"000f0605db473f88170f08df7cc086972201243c","sha256":"7bb8e8328269e6a3ecf3a70814721d70eeb3762222b9571bae99e4c05dc38b9c","sha512":"ab98b29f42ed031a1b21fd06836b607171e90595b005e722cc6be2db4d087b9305e43455b872bbac195a12a6c932f6396d8edd54b9d5cc018a031c1b2712526c","ssdeep":"","tlshash":"fbb09b974155410511d320115e231104245619eb0e4ca544390c87563f4962fc5aa7dd","size":121,"data":"","first_seen":"2025-09-11T14:57:52.830181Z","last_seen":"2026-01-15T18:27:25.117679Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/main.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6e14926c3b9f73ca15ef3f25e6233447","sha1":"df0c39160350bfd0ce26c474be3217347bf658ba","sha256":"3527ab63cf608321a7c2acacdc537b84c1330f1cc0ae8819a9bf0f10a1d76526","sha512":"24ae04f3d26feb7be5eaa72ca26abdb5e02b3bbacbde53b3d7d2450f878af6146a4f247b226e615945951a2185da364f5daffd861ba4262374ba09115eb9fe96","ssdeep":"96:NR0ENDkMACRVQ4PeneCFTeL2LW4UCa7kwrTcwE8Brs7s/z5BTJHBM0m3wdaLP:PDRkURRWedL2LW4UTAwBZs7s/lB4YaLP","tlshash":"f791555530b11467407b60656bbf450c2b69810f970baf71fc6c97841f98a2ee2b27ad","size":4313,"data":"","first_seen":"2025-09-11T14:57:52.820925Z","last_seen":"2026-01-15T18:27:25.110242Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/owl.carousel.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b7b9c97cd68ec336d01a79d5be48c58d","sha1":"1a99890b57c9859a622337ed0b2f989d6e30cc0e","sha256":"b394d33b2a7ec654a6b037ebfda6618341b3f897a362be624c923c2711b54a43","sha512":"968e18822c24c6c54827999ec766fe54750a9489d22b6a45b641854731ec00beb8fd93b9bda8823e67463f7a99ab587d333673821ae90cfdf7e92716ba050c4e","ssdeep":"768:JBA7PMMFA0tdlXKNSR4vlGRep2lcwJeL+C2jQdc7/CORUQuFBt33:HAIMFFdYMxAcLQDV","tlshash":"cb137346b3202d2a869b61a0663f160bb23a291ce414507d7d7da6de6d7dc4c213fbfc","size":42766,"data":"","first_seen":"2023-03-07T01:03:18Z","last_seen":"2026-05-23T15:36:04.962659Z","times_seen":18395,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/#shop","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"ZZ"},"introduction_type":"scriptElement","is_inline":true,"md5":"f45040c72ce0140bf0c61e86f3e52bb5","sha1":"644693c4bf01e7a8afc4488b685caf75dbae3530","sha256":"c02b7b3b35d7a0986eb47202d7342b4af49bdd45b09fceb2f008e64d6729772c","sha512":"97a08e9bb22090f7a8ae220d5b27b57b8655039d48bb39d39c694c9ccffd3ea48e50edadc33549420efda5132214c44ce72c777dbedb768816d1f22ecf9a2c28","ssdeep":"","tlshash":"3790021010629541f052205c5637135010326a633844c1ae761f82009f010c7c7360c8","size":57,"data":"","first_seen":"2025-09-11T14:57:52.825116Z","last_seen":"2026-01-15T18:27:25.114667Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/modernizr.custom.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5213eb54ae903f0cc53d18c727f767d6","sha1":"4fc1139119ebd9b56add46c4156bd0c89687eaf2","sha256":"fd057b226661f22707982844727afd6cc5be630608ce7e1b1155d03edff45769","sha512":"f7e798a8109ed1fa193d941c8f01fd1a57a93b53a8a4a25f97d1c4806ea96a63b59bc3d445d4cf3126663d8d5868be9042ae1dc5c0e3c3cc0288bfd2688eab61","ssdeep":"192:plaZK8nnsnKdgPhQKQob1dHYPeIny6bkLDDhWwpy8b7z:naZK8ntdgPhQKQoZRY5y6iHh1pz","tlshash":"3612c6c97642f216879761b6907f420bf138d86ab8184c50e059d9fcb9708f8467bf2e","size":9358,"data":"","first_seen":"2023-08-26T13:04:31Z","last_seen":"2026-05-22T00:50:56.019692Z","times_seen":32,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/jquery-2.1.3.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8770c0b14a396067512a10669fcd559a","sha1":"64b4969dccee705aaec150cbc2319100a7b1709b","sha256":"1b1bbb34d9a9c57d9fe76acd733884f6c889fd1cc224980dfb69654e5d0bf34e","sha512":"cd5db1858aaedc26f24df4a92282ceaba1cd51926229107df943ab47c5bad16147810209e80631760fd7fde08a6794676c1484e64281942e859f137793e0a807","ssdeep":"1536:AP1vk7i6GUHdXXeyQazBu+4HhiO2wd0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrb:z4UdWJiz6UAIJ8pa98Hrb","tlshash":"9a83d6d9b2c67062977734b850bf410bb17a98dab80c8c60f0a4d4e47eb4a8d517bf2d","size":84322,"data":"","first_seen":"2023-03-08T01:07:52Z","last_seen":"2026-05-22T00:50:56.06968Z","times_seen":33,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/imagesloaded.pkgd.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1a4b132632e8444a9d67a33668e195a5","sha1":"82cde155ddab45d7475754357e3874b1e3ccf911","sha256":"cc0761f78d43a0b157b46506641105ff8ea4601efa6aa56adda0938dac1c4b0b","sha512":"80063f7ad3d88041c3516f862c19319fdd202861cf94f0a94615dab066471b1d4f934419c366cb45609fd5d3ab63b5211ecf0457a281481abceb6d3a089aab64","ssdeep":"96:bw09qrHfbu49BsYrI7ZSRwJm89Q3kR0q2vRSF2ym/HRsEr44orcaJ3jv0XfLgBVP:bwxr/DbvrIEqR9AkR0xEFKsZJ3jcvLgL","tlshash":"a1b1308cb76275321297b0b2a21f030f72b6506ea518819d7659ecf65cbcd492633fb4","size":5441,"data":"","first_seen":"2023-03-07T01:28:10Z","last_seen":"2026-05-23T17:56:32.713888Z","times_seen":2340,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/masonry.pkgd.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"87b3b35237efbbe12a2357f5f3855cfb","sha1":"69a1aa94e4f3f277c0f2d308171ae28c10d74e71","sha256":"b267f36c60cf1a612ba21cba4f81983b01389bfd7de413ef17cd00f3d5f6de3e","sha512":"17f0e5a427d3f2e112dadc6292a24193128fde76a718b49a2f7104ab5e2535162d4dd5cfa6110da2efc9eda9183b2931881006e6f4e5329782ba75a25e65a708","ssdeep":"384:jr7mIr/Db/rA3u8w4r6hr/XGs3m6rMz13f3d2OUVP4eAnbhfreD6dCBEOav7bltM:X+MxXGOm713f3dqVP4eAnI0ROavPSCze","tlshash":"ddb2878e73007425428bf16a96af160f7137655c7b0790acba6ad8db1cb984d2037fbd","size":23601,"data":"","first_seen":"2023-03-07T13:13:57Z","last_seen":"2026-05-23T12:26:58.278853Z","times_seen":836,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/jquery.magnific-popup.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"ba6cf724c8bb1cf5b084e79ff230626e","sha1":"f455c5f153f872e52265f87a644ff89fe14a6fb6","sha256":"3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4","sha512":"22c361e44dde632dedaff2625f6631e2fb02ba3b6487097b48baa09f02cd81fd381ebb7d053f525e52e56655b1f8e2b89ddcc0a002e1b0c35c0a6920823641d7","ssdeep":"384:lPhVPXQ2G2XAQyqVxRQ5giCCMLtA15h5/F6l8aZwHwztLCpmst:lPBIt8I5h5t1qkOLCMst","tlshash":"bd921894f2b2b21383a735b8686f70093a729952ed06c855a55d94d87efcec89037f3c","size":20216,"data":"","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-05-23T16:23:50.359193Z","times_seen":64268,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/masonry.pkgd.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.925Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/masonry.pkgd.min.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-5c31\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=MnTUrxmQOolMe3cybeHx3l3Bl8kUtMMtpky%2BbCNWLh%2B1oZB1K%2F9hfjWuW8Z27bSXFggflmiTSsgK6qAUZQa6h7CXo7ic%2BkRmxfRFxA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168bb8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":23601,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (23465)","md5":"87b3b35237efbbe12a2357f5f3855cfb","sha1":"69a1aa94e4f3f277c0f2d308171ae28c10d74e71","sha256":"b267f36c60cf1a612ba21cba4f81983b01389bfd7de413ef17cd00f3d5f6de3e","sha512":"17f0e5a427d3f2e112dadc6292a24193128fde76a718b49a2f7104ab5e2535162d4dd5cfa6110da2efc9eda9183b2931881006e6f4e5329782ba75a25e65a708","ssdeep":"384:jr7mIr/Db/rA3u8w4r6hr/XGs3m6rMz13f3d2OUVP4eAnbhfreD6dCBEOav7bltM:X+MxXGOm713f3dqVP4eAnI0ROavPSCze","tlshash":"ddb2878e73007425428bf16a96af160f7137655c7b0790acba6ad8db1cb984d2037fbd","first_seen":"2023-03-07T13:13:57Z","last_seen":"2026-05-23T12:26:58.278853Z","times_seen":836,"resource_available":true,"data":null}},"time_used":505,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/fonts/linear-icons-font/style.css","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:57.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/fonts/linear-icons-font/style.css HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/main.css?v=3.1.0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Apr 2020 00:52:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea23862-2098\"\r\nexpires: Fri, 16 Jan 2026 06:26:58 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=u3CNwoeFMRz6%2BVttdVI%2FN58LDfQ01edCHfVqMoPSMryQ479%2BKvbJrRcIKt1DsvfvxzRc4%2BgHOvqT5oL5tJbsQzCZk5c6KIx%2BUAT7hA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca5e98a8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8344,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"aa4cd95fc370b1cc4247fec9e0f946eb","sha1":"890ddf42c64e544ed82e55c325de8f6d9dcf70e4","sha256":"f5c203b6416a054de195921e85165e4d66fd303ea8d20982a190fede7b673576","sha512":"536b39039535728a25165f40e1ea87a54d8532eb8b0945c51dd2e4cf51bd1d55e88318dee5f88a95289a87d9e152a10ea6b63683024e2f87065c29ab3c84c7ec","ssdeep":"96:0aoM6u+LfH/7Z8iFRSyUxOyUiBjiBk2652bSBQzE2p/ylzUfhTZJ3kLbPzzUhF57:wd972YYXO6Te7AxJ9M","tlshash":"5502f0a4ec4d3c825382e4d23b543e802b1ef7389d012d59d417bd2eb7e32169da47da","first_seen":"2023-04-05T07:17:57Z","last_seen":"2026-05-23T17:16:37.998327Z","times_seen":2707,"resource_available":false,"data":null}},"time_used":520,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":520,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/modernizr.custom.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:58.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/modernizr.custom.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-248e\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\nage: 0\r\npriority: u=3,i=?0\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gk%2BKDBqK%2FS2yS33HlAp1pt3ZAfxtKmrO5IBfrkWZYybYX13J45eS2JxoFncTCQ9VHwZi5buLxplBia6BjQVx7spH8NtLBVeXw93xVw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca98a1b8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9358,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9358), with no line terminators","md5":"5213eb54ae903f0cc53d18c727f767d6","sha1":"4fc1139119ebd9b56add46c4156bd0c89687eaf2","sha256":"fd057b226661f22707982844727afd6cc5be630608ce7e1b1155d03edff45769","sha512":"f7e798a8109ed1fa193d941c8f01fd1a57a93b53a8a4a25f97d1c4806ea96a63b59bc3d445d4cf3126663d8d5868be9042ae1dc5c0e3c3cc0288bfd2688eab61","ssdeep":"192:plaZK8nnsnKdgPhQKQob1dHYPeIny6bkLDDhWwpy8b7z:naZK8ntdgPhQKQoZRY5y6iHh1pz","tlshash":"3612c6c97642f216879761b6907f420bf138d86ab8184c50e059d9fcb9708f8467bf2e","first_seen":"2023-08-26T13:04:31Z","last_seen":"2026-05-22T00:50:56.019692Z","times_seen":32,"resource_available":true,"data":null}},"time_used":5,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":5,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/static/clipboard.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:58.725Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /assets/static/clipboard.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 12 Aug 2025 16:22:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"689b6a29-2a01\"\r\nexpires: Fri, 16 Jan 2026 06:26:58 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sYAFcx1jnHkFATZL5FiKzHklmMPxdCahpA5EYygPjtBsxk1SEevFlZo78T8Xp5GenTDFIsaMML%2FFBr%2BM2BuPjbJbw%2FFNuz2hFRDr%2FQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76cacfa858be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10753,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (10644)","md5":"440d9349a6bc8eb0fb35317588148985","sha1":"1f4b462a38a5657298ef2e8ac8c98f4060178bbd","sha256":"4979e7fea71c2707c8078550d5d03bbe69bfce3b415e7ce4faec7ada9d3a358a","sha512":"554c4da3331dd8ac186d935f5c4bc256ee0f9060705c6c4aac29b3427c05f4cedba03978e24794a42d5954b4d50db9804c8ebe4da691e9c0d09cd17ee1bbbbba","ssdeep":"192:N2TojWHQ4LygI+GlfHQ4LyQB3153pPN7rnoWtBTwuLJvqo5kAssU:Nrjsc+GLfB33JhoWtBT9LJSo9U","tlshash":"be229668b280b1b18ae770a9413f424bf3729469709a90d4b239d8f1adb8dcd5467f3d","first_seen":"2023-04-07T12:42:17Z","last_seen":"2026-05-22T13:11:38.172501Z","times_seen":263,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/modernizr.custom.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.916Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/modernizr.custom.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-248e\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5vZj%2Bbo5KfYO0xdAi1jGOz04%2BAGYV2uhFdlYBKDpGulgW4UkNTcn4S15mjmdid0z1TYKPCC815b8mAngF%2BsH%2BupFOlgz6BbbAec%2FJw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168b38be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9358,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9358), with no line terminators","md5":"5213eb54ae903f0cc53d18c727f767d6","sha1":"4fc1139119ebd9b56add46c4156bd0c89687eaf2","sha256":"fd057b226661f22707982844727afd6cc5be630608ce7e1b1155d03edff45769","sha512":"f7e798a8109ed1fa193d941c8f01fd1a57a93b53a8a4a25f97d1c4806ea96a63b59bc3d445d4cf3126663d8d5868be9042ae1dc5c0e3c3cc0288bfd2688eab61","ssdeep":"192:plaZK8nnsnKdgPhQKQob1dHYPeIny6bkLDDhWwpy8b7z:naZK8ntdgPhQKQoZRY5y6iHh1pz","tlshash":"3612c6c97642f216879761b6907f420bf138d86ab8184c50e059d9fcb9708f8467bf2e","first_seen":"2023-08-26T13:04:31Z","last_seen":"2026-05-22T00:50:56.019692Z","times_seen":32,"resource_available":true,"data":null}},"time_used":539,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":538,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/static/acg.js?v=3.1.0","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /assets/static/acg.js?v=3.1.0 HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 12 Aug 2025 16:22:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"689b6a29-98c7\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JY%2F%2FxiAZ4Ed3p8g84xv%2FmYRzYYpUsc%2B8uz1NBzhC6WIq2eRUyVP8PD4IPQaKr4lPaucxwSLjWEHL7NlOWmDHPry1Pvk5eN5Uhngunw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168b68be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":39111,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (622)","md5":"77ba48c2172e2f285ca8020f9e02894f","sha1":"f13c2ef6a85a2bd8fdb1c65626db6270b2e20c71","sha256":"c152d473880b931609ea9fa469c21affbe61b03e2af7246d3ef609e20a1335aa","sha512":"c6e927a862ab587e16628369c391618a3c6f2080b542e9ee69c29f4dbadd92c72fd601125d89f8799807ae9eb04957e25cdb1592e1b64fd51b148614a8bc975b","ssdeep":"768:k+j5YCOtFnD/uedTD1Rjs21kJiEsghjTYzNZwxIMpJF/pQpno2l2syL/qNz8oGe/:k+y3qxi9lxLKd4","tlshash":"b5037f1c27f715114a33b0782b9f60047a69811ba258ee08be5d97d06fc883967f6ff9","first_seen":"2023-06-02T00:24:04Z","last_seen":"2026-05-10T03:21:32.369786Z","times_seen":14,"resource_available":true,"data":null}},"time_used":506,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/animating.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.921Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/animating.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sat, 09 Apr 2022 14:33:34 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6251993e-4dd2\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Gxy%2B9Q4P9k54WF2KJGOWhNfxgio%2F%2Bh58eSBW0zV8gjNeT9ots5IuxX1UGkddbpOzXgIhMrem5oqDHHRFeSitG5Gk%2BGOPTzJu%2ByZUTg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168b78be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19922,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"11387e44165d71f00407d6906c2acade","sha1":"79e43727a7604d887d74d589090a9b5438f40982","sha256":"49806f4423d116d289ff0730a45e1da10f76cc7af6ae2e90adad29705395e654","sha512":"3facb15fb788615d4963e206bc525e86841ba83fe3793c0510df15e6ddf40d97f459f2205c95023191c1255606567c9e640cbef6939a2dca105fc1a87eb40c16","ssdeep":"384:LyCbxxvxQEY2JSbgqBeDMXkWPWJW/WDrVV1t03:LZHvxQEY2JSbgqBeDMXkWPWJW/WDrVVS","tlshash":"d492287968233ca8471ba17b662f701049b128a3933c8f78797dc5096fa2c51d16b9fe","first_seen":"2025-09-11T14:57:52.791281Z","last_seen":"2026-01-15T18:27:25.083006Z","times_seen":3,"resource_available":true,"data":null}},"time_used":538,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":538,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/reset.css","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.906Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/reset.css HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Sat, 09 Apr 2022 15:53:00 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6251abdc-4b6\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n%2FfreB7InGWobqENDmlqKRKtPffnlVQiP3kv0tyh%2BkEO%2FPVmYLT4ewdSobc70eEuFlOEZP4qZAdNQ%2Fo5HaFSbZjUGSg1t4PI%2BiZ%2FBw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca158ab8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1206,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"1678bcbf554026354ffc80fdeacf2cf1","sha1":"3f4bafcc1c0a34bf82b9706444a43b11e07ad3fd","sha256":"5f2897f450bcd6c19384473d5575492a5d8952d78c2855080c415edf17779814","sha512":"d34d1f64403aa5fd0d8676ca31b710e44aed9cdfb96e45e47c02f3737189e7be1afa0d742c331a150756bdedfde6154f089d2759036ad13c1521ad6e96c034ca","ssdeep":"","tlshash":"3b2174906bd2f91001cb012783d3132a3d64852dfb1fbe789ce9106c8b40b6911f33ba","first_seen":"2025-09-11T14:57:52.769189Z","last_seen":"2026-01-15T18:27:25.085262Z","times_seen":3,"resource_available":false,"data":null}},"time_used":527,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":527,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/bootstrap-grid.min.css","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/bootstrap-grid.min.css HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-7131\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eWsyKnpajMbWef25cUTxHsw2kF1XnbsxefJG9mBQBxfkyDVAjTPrPfQ98HtpPQt1zl7KMq%2BsJwQ7D3M%2B7gAq2aUm029ZfCXJr5Js6g%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca158ac8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":28977,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (28709)","md5":"71671e5000bc7347d6080c92b0bfeeb4","sha1":"0560593b3d9210132122afec4bfada6c83d809bc","sha256":"be5fb4a7f676f11715bc2f9ca1f52221e62eb0674e73809793fb5aaa0436fd75","sha512":"79c422f5503f68591ad128df3c0270f18f6193f3eabd6a79c2d3742649175acad0fa5e2fd2f3e994cd49558ae48e739ca329a11a201e108a25c3f2cb0ea0a682","ssdeep":"192:3SX6t3cQAnAIBNtYaFRqXhDSmIACpL6Ld:iXiExucIz","tlshash":"6bd29ba3f4b11a9d4512c40c14d57bfd48bfd489e7b29ef9a8632770078a1e74ee248e","first_seen":"2023-04-14T00:53:40Z","last_seen":"2026-05-22T00:50:56.0613Z","times_seen":327,"resource_available":false,"data":null}},"time_used":531,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":531,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/favicon.ico","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: image/x-icon\r\nvary: accept-encoding\r\nlast-modified: Mon, 08 Sep 2025 19:17:58 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\netag: W/\"68bf2be6-6a4e\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9f3fsW0NyYHkNC%2Fv5QHHKJnvsogpSkVAqmlv3G2lam9UDK2QHtNdyuVsnwAjDa57E3R4%2Bz9rLfY0CprfSNo06zZM215dlzLwn%2FGNfg%3D%3D\"}]}\r\npriority: u=4,i=?0\r\ncf-ray: 9be76ca168b48be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27214,"size_decoded":0,"mime_type":"image/x-icon","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3","md5":"e65b10c558214a8f3e1811fced3a3657","sha1":"b635effa1371504d452034f9dd030fa6b19e5ce7","sha256":"4fe3510061aa824b2b4389a247d1ee47295b8fecd6b9e7678bd2b4fc6217c1f4","sha512":"b64576c52a363bfbddeccf62cb15b9917e49911e5a650c1cbefbcd53a2d1f06f1397a8b71678bdbc37df3eb2afd4199ef033c434884ba36cdb4e6a64b5a3512a","ssdeep":"384:KeUtJw4jZmXghuSTZiQvlDn2mpV9GsbMbnBAoYG583UzkpZvhG3mTJRLjJ:1UtKghum3jpVTbMbnK2gUzmZqmN1J","tlshash":"a6c2e141e40907a7ef17ec5758878a0906daf781e444fd0eadeae414cc38efd9515374","first_seen":"2025-09-11T14:57:52.786852Z","last_seen":"2026-01-15T18:27:25.088213Z","times_seen":2,"resource_available":false,"data":null}},"time_used":692,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":520,"receive":172,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/jquery.magnific-popup.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.928Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/jquery.magnific-popup.min.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-4ef8\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=n6bvIKJ7GgQNg4mGWwzE2Rlf6f%2FNyTSsGTmXoK7s8qLJKXDqCl5vjzR2rGjXCMBAaerVLYzvHuF1MVCrUG1pWdDeCJ5cIFBJaDHtiQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168bd8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20216,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (20087)","md5":"ba6cf724c8bb1cf5b084e79ff230626e","sha1":"f455c5f153f872e52265f87a644ff89fe14a6fb6","sha256":"3fddc6d28aba3c13d64cfd4847c333ff48c71d4a5a58bd1a0494ca6ae8ac1bb4","sha512":"22c361e44dde632dedaff2625f6631e2fb02ba3b6487097b48baa09f02cd81fd381ebb7d053f525e52e56655b1f8e2b89ddcc0a002e1b0c35c0a6920823641d7","ssdeep":"384:lPhVPXQ2G2XAQyqVxRQ5giCCMLtA15h5/F6l8aZwHwztLCpmst:lPBIt8I5h5t1qkOLCMst","tlshash":"bd921894f2b2b21383a735b8686f70093a729952ed06c855a55d94d87efcec89037f3c","first_seen":"2023-03-07T01:02:00Z","last_seen":"2026-05-23T16:23:50.359193Z","times_seen":64268,"resource_available":true,"data":null}},"time_used":519,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":519,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/static/layer/theme/default/layer.css?v=3.5.1","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:58.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /assets/static/layer/theme/default/layer.css?v=3.5.1 HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:59 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 12 Aug 2025 16:22:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"689b6a29-37bf\"\r\nexpires: Fri, 16 Jan 2026 06:26:59 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=W5rRy4tOsUJjQroo8uW0pkA1Q3kt5kXMUNSUsHEGiqxQDbyRF2WF8%2FNJiWu5FrVt3b%2FMEFs5pN%2Bny9l7axsrNDqj3h0YLHnNoVReAA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76cacfa848be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14271,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (14271), with no line terminators","md5":"c234eb06d5f32055092294e78957f17d","sha1":"f15ee0bcb9694f32f5e1d524f2653aa0dd043402","sha256":"5cdf3edb27b0c9f8e48918c486e9ae65a9e5beab806b64c4a7bc5bac53c0f540","sha512":"3f06b51116d7f8026d81c7eb6a3c4d871462d09fe0a5b8cc8b7feaf20cbc88b0b6a545f0ec7cbc17566a9ff609405f58fad6eddfb3a8b3f6d530ede8fa3fad5c","ssdeep":"96:mp+Ntha8qNEp+wRY1vUPXi0nMLPD2OtLzAyPHL/LztJDzyv2OQ7KGx1j9d2/nWUU:1ELr2Otzrzzt42OQ7KGx1j8WUq4S3cU","tlshash":"f75242e144911299b0278721d6dc7eba32f88d43e5630caef2573c1f874c6dba2b6647","first_seen":"2023-03-10T11:40:20Z","last_seen":"2026-05-23T16:42:33.612845Z","times_seen":51976,"resource_available":false,"data":null}},"time_used":519,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":519,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/cache/images/202508130225186225847.png","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:27:00.984Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /assets/cache/images/202508130225186225847.png HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:27:01 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 12 Aug 2025 18:25:18 GMT\r\nvary: Accept-Encoding\r\netag: W/\"689b870e-304429\"\r\nexpires: Sat, 14 Feb 2026 18:27:01 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VpG3mS2KXGEMecr8WswHcyq5B4AzGYGFE%2Bj2COu5A01yHrPV9wWV6eT5d4wCUUw9344csGUUz0Wpb2PBIOh%2FW%2BZgvdpDUBColIqACQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76cbb1d498be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3163177,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1024 x 1024, 8-bit/color RGB, non-interlaced","md5":"cac867eeb0bee000d792ded3cddade25","sha1":"732575186e045ec4d774cf9bba21355cbced343f","sha256":"650f38f1042fa8289fd3196423388f40cbf82918e13cfc028d1dff99147ffb8b","sha512":"2fa9516cfeadfff53b8d2c20fda7647101bddf6ad9b9a24d29630c13fb5e4b7e99feaa1c549359aac29735608e62cc0fa746c3fc5a5bd175e3f04a51543cf93a","ssdeep":"3072:wItMz9K3QYQIy48toaKUDD+IT6v2j07mG7K:9MzA3lBy487K3OmmT","tlshash":"7625e8037f01d802d5a62db68d65c7e86324fc499e15939734e7ee6bbdee1d38d02288","first_seen":"2025-09-11T14:57:52.77433Z","last_seen":"2026-01-15T18:27:25.091784Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1404,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":703,"receive":701,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/main.css?v=3.1.0","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.915Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/main.css?v=3.1.0 HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 15 Apr 2022 10:05:22 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62594362-11cb1\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mNcyYC6BBm9Q6rG%2FKjl9Y5x4YJCL3m%2F9Qax7l0m4zf7Ah7jQOG9qtebYZ4fO08sTYB1Mof4DRjHfGpRHt5bCrFRMitoRc0q%2BYHefhg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168b28be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":72881,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF, CR line terminators","md5":"69a91f596a6e5c6c15146bbb6103702d","sha1":"94a6cadd3e1ba9c2f218707f4fefc8cd0fcad67d","sha256":"9963bf192c4138b54b74a8f8bf452dd54eb84116dbc7febcc8317c02ede5aea3","sha512":"75b7d67ca2d6b33c39fedbc9593ae07d95cbfe31ea01e430e94370641159a27d15b71316ccb55db16233aa70a4e1cbc479e814029bec0a372ee4b741c51f4ec8","ssdeep":"1536:yTgDEQtUJRyi9sOa0OtHOIGOrLOG0O5lOEnOneOiHVha3z5Qpja1E:AfHQoi","tlshash":"6463636dde1111426137db68abe22756eb684023db0200adbbcd63418ff967c817ef9d","first_seen":"2025-09-11T14:57:52.803201Z","last_seen":"2026-01-15T18:27:25.093432Z","times_seen":2,"resource_available":false,"data":null}},"time_used":717,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":716,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/fonts/fontawesome-free-5.12.1-web/css/all.min.css","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:57.594Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/fonts/fontawesome-free-5.12.1-web/css/all.min.css HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/main.css?v=3.1.0\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Apr 2020 00:52:50 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea23862-dff5\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2c35msfvgCwcL23DgME2gw%2BDMb4mhT4h44c2Ut1ESQQQv2AzfpA2jJ34o9UBwZa7vFOHU9stEMKyrKkxKH95lZqIKqxcNvQlHED0oA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca5e98b8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":57333,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (57147)","md5":"2a0e11a7655cf7af50d9152727c134ef","sha1":"136e6626dc83d228b50416249fe05864ab065e40","sha256":"9a680b90260b5106d79f4075491ab31daafa7429eff686453c40b58357309649","sha512":"f41c0b015aaab7aa05757a213cbb8d1f1871dfa0558f9b864869a2ce4986920977b8c4a035a94a73fb26ba6f86254fd34cfd23cb4fabbb00b7c4d024dc5ef9f4","ssdeep":"768:xEC319PizNq4/xeo8UHJPkQBR/oMQyYJrXA5CthZQzj:xEkPUE4/IuHRBBWfdAstAv","tlshash":"2d430cb8e54c01c9a731c44fbf82b2bc61b6f73de5910d95f00e691c2ad26a811c5fba","first_seen":"2023-04-05T04:41:55Z","last_seen":"2026-05-23T17:18:33.079982Z","times_seen":6554,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/user/api/index/commodity?categoryId=0","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:59.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /user/api/index/commodity?categoryId=0 HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:27:00 GMT\r\ncontent-type: application/json;charset=utf-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iK%2FZN9cGlgDpvQiqhwUcxqUBCKU8DJepEnRC381dlZ1O5a1DfZtIOEMY26PyqEJDTJkQHply9MBrTBg6sHQIWJIASr5b3UaCDYDvng%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76caffafc8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3027,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6018e1f630b99aca2728a3be69775215","sha1":"3ba5bd2a769f11c7814857b58fad8a4668f4b843","sha256":"7fe55b94a0e26a14a655fce6675fbf72e20e2da523d5d7ddb88774082146374f","sha512":"7e92700915cff782e8804ae924f10574435cff82ce4d4666821debecfeeaeb26455b43476927ef7d05b0af7456ada969f92715a8d9bf29e4c278bad311ed2472","ssdeep":"","tlshash":"5c51f178a55c18fe66770191bc0fbe97358c0ad74f928ff259adcf9800f48166729129","first_seen":"2026-01-15T18:27:25.096085Z","last_seen":"2026-01-15T18:27:25.096085Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1767,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1766,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-15T18:26:56.084Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Thu, 15 Jan 2026 18:26:56 GMT\r\ncontent-type: text/html; charset=utf-8\r\nserver: cloudflare\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mvtOLxbc2frxXcpx%2BTO5vHJixjneKH3A5QMP1LljaacIaWqNxFasUjP%2B43Ks4NpN7IDLm8qbkrAOPOm3LwjzfbmiUW7SzmSX6agNkA%3D%3D\"}]}\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncontent-encoding: br\r\ncf-ray: 9be76c9cee560731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Modernizr","description":"Modernizr is a JavaScript library that detects the features available in a user's browser.","website":"https://modernizr.com","common_platform_enumeration":"","icon":"Modernizr.svg","categories":["JavaScript libraries"]},{"name":"jQuery:2.1.3","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"OWL Carousel","description":"OWL Carousel is an enabled jQuery plugin that lets you create responsive carousel sliders.","website":"https://owlcarousel2.github.io/OwlCarousel2/","common_platform_enumeration":"","icon":"OWL Carousel.png","categories":["JavaScript libraries"]},{"name":"Magnific Popup","description":"Magnific Popup is a responsive lightbox \u0026 dialog script with focus on performance and providing best experience for user with any device.","website":"https://dimsemenov.com/plugins/magnific-popup/","common_platform_enumeration":"","icon":"Magnific Popup.png","categories":["JavaScript libraries"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29757,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (937), with CRLF, LF line terminators","md5":"62de217210b5490df38ecbdad33b3667","sha1":"7ad0fa4878363216a85afdfa1d80e6aca980b180","sha256":"4f44410b4aa9235038e20b2730f8bcd0bf4cec61de47191adce37283d34d21f1","sha512":"1c8fecb33b091f07a0f48bf87314f764cc607d918f1692da5d44a0bdd3ed813a43b696ab05f51f66b502d155e4836840dbf9095be744b6cdeb920815e30600ed","ssdeep":"384:6tTWJN7ik22S55a4NbbzSYl+lT2ReVlpCLAoWgOYAEZLP1kYFz:6tTWXWk7S55VG0RkpnoPOYP","tlshash":"fed2732528d688270033e3e6aa719719ffd5520bc7068908bafc97d31ff2d419d63e5a","first_seen":"2026-01-15T18:27:25.097337Z","last_seen":"2026-01-15T18:27:25.097337Z","times_seen":1,"resource_available":false,"data":null}},"time_used":710,"timings":{"blocked":65,"dns":44,"connect":1,"send":0,"wait":580,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/owl.carousel.css","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.912Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/owl.carousel.css HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-1010\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KjDKOyEhNPs91wKNEIyhyYdn2J5OV4Ve2hVzEWFaoLnEBJoa4xwb3HU5sOTdJs4SwaFbH9nPf1ucAtXSLlxH%2Fc6vfd%2FhN%2FZKnSlB%2BA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168af8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4112,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"0c44b1327d7299a41c854b09bce96f83","sha1":"438bda2210ba505d1c5067977bddd85bde2d90d6","sha256":"7342aa28694e4ad5609e0b47a82f860d116a0231f81dea54437127015e82ca3f","sha512":"9d006dbb9113c534b393626ba00095606cf7851ee5cf5c258bcf9149e1215f42844493a92db97e8fb3ad1b0beba84e8319d9b8c72569b7bb407c5646043abeba","ssdeep":"96:OTgJdduXehkNbIAIhIL4NV5mVrKWT+8FjFE9pgrYJ7gBuU4X:OTgJ/upNbIAIOoV5mVrKWT+39pgk7gtc","tlshash":"9c81dde72167010e381b93e01aad6a56393d8443d81d8c58b6fb5609cf8ef98215ff5f","first_seen":"2023-04-05T08:09:08Z","last_seen":"2026-05-23T10:53:38.372643Z","times_seen":993,"resource_available":false,"data":null}},"time_used":532,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":532,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/perfect-scrollbar.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.924Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/perfect-scrollbar.min.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-608f\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4HWRgvFJ70v%2F65HRtfgGvLxlLZ317P4Y%2F6crHK%2BcO6MDZ%2BJbA1gab18jyb2yvJbmpRaAILQ2X5iiSdg9HZy1OnvaopIBH6BhjdcwFQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168b98be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":24719,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (24688)","md5":"a85bd83466acc018be87dcf8a9175892","sha1":"85bf4c744111b36095cc3afa56857c80473a218b","sha256":"5746f9b41e4ce17a55368c6e241c422b1dacd8f6b0652b6472b0e9216b23a300","sha512":"8c549f5e9d77dff2d6231dffab34fee73d693a28fbdfb1d6c1577fc86557d195535052f2f3cea658f2c3b064a2aa8ac86d724edd4800799c67e00cad226c7495","ssdeep":"384:RCQfouNtwIA7zcaxo3kfZmUF6UF1xtjhUlA4JWk4h8tCCQ9gQZQiQqWQuQsjupWA:RC1uNtwIxA4JrS3oLTK","tlshash":"11b2944cb21070a082ff315dc1db8b0e72725453b74fa5d0a490dfb8a9787ba2356b6e","first_seen":"2023-03-07T01:02:56Z","last_seen":"2026-05-23T17:16:38.003327Z","times_seen":795,"resource_available":true,"data":null}},"time_used":519,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":518,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/img/main_bg.png","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:58.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/img/main_bg.png HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:58 GMT\r\ncontent-type: image/png\r\nlast-modified: Fri, 24 Apr 2020 01:12:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea23d10-c7b8\"\r\nexpires: Sat, 14 Feb 2026 18:26:58 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2R7Bl0nEoXci9s5g%2FCVBnEqfGiQWX44tJIUsE1YnApac5ib%2BgqEJQQHXMHTeqFvPrpXtsU92LBP2mntqQC7Bocr82M3wFIZsc2J1Dw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca98a1d8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":51128,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 2560 x 1600, 8-bit/color RGBA, non-interlaced","md5":"158722421e5a8ea241d2cf080b91e7ba","sha1":"28d86016a7bdaa5039722a38be2d4f5d564e0a44","sha256":"ee8273116f02725fdf8e03507728e2664fffc511d8a149e5d1965613591b36a7","sha512":"0b7564348835a923b5d37a93cf99f8af8057e33f556d9495265d443daec58fc6ab166974b93143fef66e92f54e5675d5f53dd13376d43db94095e3dcf9a008d9","ssdeep":"1536:M2fEZBBBxyKfZb2MOLquVjSvQRdS2UIMICxneH0cNnpUXgm69Q0B6iHUqwmgmvm:hYBzybLNVjSvQRdS2UvICxe0cNnpUXg0","tlshash":"6d333b1d7a0186a4c57c1d3651b6eff02b622254a4275a373fb8c3dbcdb2b883f95489","first_seen":"2023-12-05T11:23:18Z","last_seen":"2026-05-22T00:50:56.027496Z","times_seen":27,"resource_available":false,"data":null}},"time_used":347,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":346,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/fonts/fontawesome-free-5.12.1-web/webfonts/fa-solid-900.woff2","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:58.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/fonts/fontawesome-free-5.12.1-web/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/fonts/fontawesome-free-5.12.1-web/css/all.min.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:58 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 76120\r\nlast-modified: Fri, 24 Apr 2020 00:53:06 GMT\r\netag: \"5ea23872-12958\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q2gv0nAV2FeT%2FWoE7jRAr2YuTVIo4QIpGGLcKRGoPcDg3cq9ut7MCRvJf60rHVmAeysjAKm7pWbEdL3Uov5xAEpbE8D7JDv1p0%2B0Rw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9be76ca9ea248be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":76120,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 76120, version 330.-16188","md5":"55eb2a60e8181f0e68b558c991973bf0","sha1":"af776f52d579da211590e0691d554b88a69dfe61","sha256":"2c3097237d60f42e800ebe4009c9af144bb19e5581e1c0501c7b259eee7e210c","sha512":"64036b3ea658d7f37dc9949dd73c68c3d929e298f9519388c479a802d380bbeb4d1827b846726442228db06a73c9188fe1af09a23fa388a68051d21fc5cdbfd6","ssdeep":"1536:kCRphZWtYYTUGxQsjuTdzmhLIG3HkbDInbsRw:kCThfG/juT4LIG3HODPw","tlshash":"f473029cdf1b184a911eb3224ca8e42c424016f54d6a37465266efddf043ef9bbbc644","first_seen":"2023-04-05T04:41:55Z","last_seen":"2026-05-23T17:18:32.987744Z","times_seen":10283,"resource_available":false,"data":null}},"time_used":863,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":523,"receive":340,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/cache/images/202508130224099004049.jpg","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:59.198Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /assets/cache/images/202508130224099004049.jpg HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:59 GMT\r\ncontent-type: image/jpeg\r\nlast-modified: Tue, 12 Aug 2025 18:24:08 GMT\r\nvary: Accept-Encoding\r\netag: W/\"689b86c8-ee2f\"\r\nexpires: Sat, 14 Feb 2026 18:26:59 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4k2sEqaj3%2BACRDZbsMeIm593e%2B64dfctM3DXCz0B5a%2FdQnVjjU4GTE%2FhDjGWz4uy4nAlY8wVMPg%2FqXn9Wa8%2Bx9Lg7fszsGdBwH3p7A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76caffafb8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60975,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"ee64215d942bcbc81c84e6b64a90b3e9","sha1":"e2d9ceabcdfc134376aa7cb9580e040dd0193888","sha256":"2c97cba44296162b843ef8d9f2c8ffb722fe60dd1f55b5057c9b3c366abe681b","sha512":"e09e5c9cf8ddf98ef79222c82259777402093bc2ef16f17bfd9e85808744fea82a77b7c70ccedcea4ebb976108f58378fe1046f7e08847fe7557f8ead8d02909","ssdeep":"1536:oa01n6cbBT6ltFaIWqgSvdyhIyNSN9R3yAcJLymbCfSdE322BMmWP:F01n6cbItF3g/IySzyJQSKfKmWP","tlshash":"f153f1973717f88f4230b2746dd940bb1476667ef1263c6e67749ed1542a2320baf283","first_seen":"2025-09-11T14:57:52.780355Z","last_seen":"2026-01-15T18:27:25.101566Z","times_seen":2,"resource_available":false,"data":null}},"time_used":858,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":689,"receive":169,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/perfect-scrollbar.css","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.910Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/perfect-scrollbar.css HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-113b\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nqZeycrn%2FZ3HTiSEiQ5cTLJ81PN8tnVTdDjEnEBD2Fkd62t8SzRb5R%2FPbo%2BvnAYhtKScqASko7R5SYos2AFmwWPKsc%2BcUc0sSSEmug%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168ae8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4411,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (4380)","md5":"08e2fedb728fd5bd6eb275267c4abd4e","sha1":"84f219236882f69faaf217bf95059289499e7a63","sha256":"da32f470ed41187dd9a27b7a293f224de7266023bf7c7cdf65804df7345219f4","sha512":"7dc29cbad8b57515f75d4b9ec84c06b563592d3b19215c698d2c5c5d8c44e0b3db94c75fd6a8677aa2cc499812629928026b52e76bd1663b4fe68a8695723c2d","ssdeep":"48:eroJBSJoLrJVvHGTc7gffGTc7gfpMY5DX4TEe:eroiGf3vHGTc7gffGTc7gfpM2DX4D","tlshash":"289138b05a616ac433bfa51ff6e6579610698063ee2e0a6cf2af3df063047bd2533444","first_seen":"2023-12-05T11:23:17Z","last_seen":"2026-05-18T08:47:50.189727Z","times_seen":14,"resource_available":false,"data":null}},"time_used":541,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":541,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/magnific-popup.css","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/magnific-popup.css HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-1e66\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jI%2FzXwz%2ByWadfNGlgaYpKOqdiB3V0ZrBSJIoMTPHEr%2Bp8h3ziEzjM9%2FivZRysOL4MVSYtAuHo0pKYrdJR1AI6%2ByBvwX2UzVTxnxDBA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168b18be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7782,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"d9920890273b4a32910f71ffaff453a4","sha1":"50e646d317c7706442c864d91c2cc721841d0f0d","sha256":"dd1d2cbae42b0e35d1ed3c55cec51d8b19cd10a0c5d6dbefb0386412857d5580","sha512":"cd85de830f52a86b7ff60eedeb7c349e72c727921f3cb638d8dda8b57e91f0cfc57a153ecb6ff500d39d1f9c0345859683e612173f587e57a0690859fd1a404c","ssdeep":"192:hR5bzzyIy++mc7f7Y3n2s96/LEpeXHFykgxe:llEDY3pSFh","tlshash":"87f11ee39bb22301e526eaa4a697a75973164013e71fcc6bbfd22448dfcd3c85163784","first_seen":"2023-05-10T12:06:39Z","last_seen":"2026-05-19T23:47:27.129595Z","times_seen":34,"resource_available":false,"data":null}},"time_used":504,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/jquery.shuffle.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.924Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/jquery.shuffle.min.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-387e\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pdPEjXVL0ZRVPQNv0OdytiIODnCPm3lkI8R7QQm7GCEfisoNqlAAPSJy7C0ndIESke5aI9Fw6SBfD4AFcSQOQjeq1ItW0mnr%2FAhc7A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168ba8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14462,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (14278)","md5":"6bbd7d1cdc7142d8b48687650a49510a","sha1":"b3ea6678dda3726adb08a4f61fb41c4c1b83d51d","sha256":"59ae6e57567a00b332a40e47ce2800a5f6792c0b6525ce4e354406f413ef7dc9","sha512":"039091ef5788237be2dbf5632c45990837bb1f3836935eaaf50dc0974d9c55b168d3a187ade5fa6d91304b1e7f5204b46c58eb810e6fee797b836e8db690fb9f","ssdeep":"192:xk25CBW2Por27/PePg0KWGAKRcbW8Wwakq4pmqbrSRbiuVBKuGdBLAMqhn:WqCAWdWGAKAWZymqb+Liz0x","tlshash":"c15261c7799035659353e5a121ff010f223e58adbf4548bc78a8c8e96a7a84c3933f78","first_seen":"2023-03-07T13:02:02Z","last_seen":"2026-05-22T00:50:56.033459Z","times_seen":107,"resource_available":true,"data":null}},"time_used":509,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":509,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/owl.carousel.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.926Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/owl.carousel.min.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2020 00:52:56 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea23868-a70e\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=YBDLITvh8EBskMcsUqKIFFf3Iao2gUG5k8VkZ6uIxQFpr8JyhVOLGyHbmKk9mOPxyuapUwQo0bMhjUlgOxclLUUUOZRY1u%2F2%2BrEdXQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168bc8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":42766,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32000)","md5":"b7b9c97cd68ec336d01a79d5be48c58d","sha1":"1a99890b57c9859a622337ed0b2f989d6e30cc0e","sha256":"b394d33b2a7ec654a6b037ebfda6618341b3f897a362be624c923c2711b54a43","sha512":"968e18822c24c6c54827999ec766fe54750a9489d22b6a45b641854731ec00beb8fd93b9bda8823e67463f7a99ab587d333673821ae90cfdf7e92716ba050c4e","ssdeep":"768:JBA7PMMFA0tdlXKNSR4vlGRep2lcwJeL+C2jQdc7/CORUQuFBt33:HAIMFFdYMxAcLQDV","tlshash":"cb137346b3202d2a869b61a0663f160bb23a291ce414507d7d7da6de6d7dc4c213fbfc","first_seen":"2023-03-07T01:03:18Z","last_seen":"2026-05-23T15:36:04.962659Z","times_seen":18395,"resource_available":true,"data":null}},"time_used":663,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":662,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/static/layer/theme/default/loading-2.gif","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:59.259Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /assets/static/layer/theme/default/loading-2.gif HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/assets/static/layer/theme/default/layer.css?v=3.5.1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:59 GMT\r\ncontent-type: image/gif\r\nlast-modified: Tue, 12 Aug 2025 16:22:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"689b6a29-6fb\"\r\nexpires: Sat, 14 Feb 2026 18:26:59 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=4,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Wwkkc45X4Y49GCdTWf23fQwsU%2Flfa6QGkButlks%2FKUUAgfzNIOt67FaumA0beO%2FngmSO2vEzuze%2F1YCpzmXE0W2qkbXYhmz3ptnSWA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76cb05b0d8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1787,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 32 x 32","md5":"50c5e3e79b276c92df6cc52caeb464f0","sha1":"c641615e851254111e268da42d72ae684b3ce967","sha256":"16ea0cf66d51efdbbc2a62b11ab0419fa72fb3320844f1d0d710480245ac9925","sha512":"06afb0ee97d49b23b8de5ccf940a95d8497fc0b19a169aacbe7924dd0a088df65c3d1f4ae7d73a31a1fc7b5a1569fedead1f1757c10c281a1dd61564b9cc39fa","ssdeep":"","tlshash":"86310b7ebd2352bff98950b6c47c554c6bb638e4c0818286032d74a5bd3576d104d43c","first_seen":"2023-04-15T15:36:17Z","last_seen":"2026-05-23T04:42:19.817756Z","times_seen":2248,"resource_available":false,"data":null}},"time_used":523,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":523,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/favicon.ico","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:59.558Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:59 GMT\r\ncontent-type: image/x-icon\r\nvary: accept-encoding\r\nlast-modified: Mon, 08 Sep 2025 19:17:58 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: br\r\nage: 2\r\ncache-control: max-age=14400\r\ncf-cache-status: HIT\r\netag: W/\"68bf2be6-6a4e\"\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=v5Tyuc5KlnuCu2hJH7U8xrfehelnb5TBGIqc3Lvapz86z0vZUjcNeVyLIHxHoQWKbLWhvZl3601j%2B3TmUZ9P21xtTFNxcg5ZTe%2B0SQ%3D%3D\"}]}\r\npriority: u=6,i=?0\r\ncf-ray: 9be76cb23b428be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27214,"size_decoded":0,"mime_type":"image/x-icon","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3","md5":"e65b10c558214a8f3e1811fced3a3657","sha1":"b635effa1371504d452034f9dd030fa6b19e5ce7","sha256":"4fe3510061aa824b2b4389a247d1ee47295b8fecd6b9e7678bd2b4fc6217c1f4","sha512":"b64576c52a363bfbddeccf62cb15b9917e49911e5a650c1cbefbcd53a2d1f06f1397a8b71678bdbc37df3eb2afd4199ef033c434884ba36cdb4e6a64b5a3512a","ssdeep":"384:KeUtJw4jZmXghuSTZiQvlDn2mpV9GsbMbnBAoYG583UzkpZvhG3mTJRLjJ:1UtKghum3jpVTbMbnK2gUzmZqmN1J","tlshash":"a6c2e141e40907a7ef17ec5758878a0906daf781e444fd0eadeae414cc38efd9515374","first_seen":"2025-09-11T14:57:52.786852Z","last_seen":"2026-01-15T18:27:25.088213Z","times_seen":2,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":5,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/animations.css","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.909Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/animations.css HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-a7e5\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=2,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vmVUTd2dWbPPsXfviRshUOEIo%2BbDBy54wDYEqmYtNdW47ck%2Bipf4olpB%2FrpEq8LnKF%2FEHqxdREC%2F1DsCqA6MxAn8Bm%2FYU8novwT1Ug%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168ad8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42981,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"c97d83f8d4a5be363b17dbe9551cef21","sha1":"d0d6ed6de45eb43f26974065cd531581fa25b0d3","sha256":"41eb1e00b29a4b948f030df4a57d4b6d7813d767d3c37c098652fb41855d58f5","sha512":"04444e8212e02ab74c726468744e1ef05f0c619df9c587440c0e00a1bd0cffd8c0042e03e683240a1739463b5cfbb44c1cfeffaa0c3a47e2f463e65ed94de757","ssdeep":"768:k+uM8645I0JuJ8wuI89ug8auQ8yuduK8p8Hu1uK8H87uQun8m8kSK4fSncItEQVh:5uM8645I0JuJ8wuI89ug8auQ8yuduK8i","tlshash":"99136fbb20d02a844e130f5597cc5e584b6895936c369cf973937c8fc7896ac229e72f","first_seen":"2023-08-28T04:11:10Z","last_seen":"2026-05-18T08:47:50.230962Z","times_seen":16,"resource_available":false,"data":null}},"time_used":515,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":515,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/jquery-2.1.3.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/jquery-2.1.3.min.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-14962\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=kduf1bB5d1B6rqrDI4odKXs1VRTtKI3uroas%2FyK%2B3eidHhlgXELpPwdoFniGt%2FBtYCpTlHYd4kZ23yNsgl7joqEfatR%2F0qdRacmQjw%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168b58be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":84322,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (32180)","md5":"8770c0b14a396067512a10669fcd559a","sha1":"64b4969dccee705aaec150cbc2319100a7b1709b","sha256":"1b1bbb34d9a9c57d9fe76acd733884f6c889fd1cc224980dfb69654e5d0bf34e","sha512":"cd5db1858aaedc26f24df4a92282ceaba1cd51926229107df943ab47c5bad16147810209e80631760fd7fde08a6794676c1484e64281942e859f137793e0a807","ssdeep":"1536:AP1vk7i6GUHdXXeyQazBu+4HhiO2wd0uJO1z6/A4fGAub0i4ULgGiyz4npa98Hrb:z4UdWJiz6UAIJ8pa98Hrb","tlshash":"9a83d6d9b2c67062977734b850bf410bb17a98dab80c8c60f0a4d4e47eb4a8d517bf2d","first_seen":"2023-03-08T01:07:52Z","last_seen":"2026-05-22T00:50:56.06968Z","times_seen":33,"resource_available":true,"data":null}},"time_used":679,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":675,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/imagesloaded.pkgd.min.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/imagesloaded.pkgd.min.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 24 Apr 2020 00:52:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"5ea2385e-1541\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LtoZI6hh21r4X7S4aheeCZgz30z5PD8D1kqt2FTEvumWwe33PbKHNgXFPrbEBLhn7WR8GElznfBX8az4jSiGwFpgkr%2Bzs6tXwj5FpA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca168b88be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5441,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (5324)","md5":"1a4b132632e8444a9d67a33668e195a5","sha1":"82cde155ddab45d7475754357e3874b1e3ccf911","sha256":"cc0761f78d43a0b157b46506641105ff8ea4601efa6aa56adda0938dac1c4b0b","sha512":"80063f7ad3d88041c3516f862c19319fdd202861cf94f0a94615dab066471b1d4f934419c366cb45609fd5d3ab63b5211ecf0457a281481abceb6d3a089aab64","ssdeep":"96:bw09qrHfbu49BsYrI7ZSRwJm89Q3kR0q2vRSF2ym/HRsEr44orcaJ3jv0XfLgBVP:bwxr/DbvrIEqR9AkR0xEFKsZJ3jcvLgL","tlshash":"a1b1308cb76275321297b0b2a21f030f72b6506ea518819d7659ecf65cbcd492633fb4","first_seen":"2023-03-07T01:28:10Z","last_seen":"2026-05-23T17:56:32.713888Z","times_seen":2340,"resource_available":true,"data":null}},"time_used":548,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":548,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/js/main.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:56.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/js/main.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:57 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 27 Apr 2022 14:45:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"62695720-10d9\"\r\nexpires: Fri, 16 Jan 2026 06:26:57 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AVHI8knBGAI2kDp2Xt4FstU2eHxagTysua3xk6bCrSsU5qiDDsVYl73p8WHOywRI5Xg0FpkgnIGNNCtwUOTslq%2BdGRcqBOJncVw4LQ%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca198c38be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4313,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"6e14926c3b9f73ca15ef3f25e6233447","sha1":"df0c39160350bfd0ce26c474be3217347bf658ba","sha256":"3527ab63cf608321a7c2acacdc537b84c1330f1cc0ae8819a9bf0f10a1d76526","sha512":"24ae04f3d26feb7be5eaa72ca26abdb5e02b3bbacbde53b3d7d2450f878af6146a4f247b226e615945951a2185da364f5daffd861ba4262374ba09115eb9fe96","ssdeep":"96:NR0ENDkMACRVQ4PeneCFTeL2LW4UCa7kwrTcwE8Brs7s/z5BTJHBM0m3wdaLP:PDRkURRWedL2LW4UTAwBZs7s/lB4YaLP","tlshash":"f791555530b11467407b60656bbf450c2b69810f970baf71fc6c97841f98a2ee2b27ad","first_seen":"2025-09-11T14:57:52.820925Z","last_seen":"2026-01-15T18:27:25.110242Z","times_seen":3,"resource_available":true,"data":null}},"time_used":524,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":524,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/assets/static/layer/layer.js","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:58.173Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /assets/static/layer/layer.js HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:58 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 12 Aug 2025 16:22:01 GMT\r\nvary: Accept-Encoding\r\netag: W/\"689b6a29-58d2\"\r\nexpires: Fri, 16 Jan 2026 06:26:58 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\npriority: u=3,i=?0\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=z7jue%2BKuMgJ8WTIUOrSpREFN%2FMYLrhkmJeny8Jbz8L6v8rLnNN6H9Kb3kkSOof8GUZfQGf8aM7CTwH6BbfNUzul1uNYdxlYcSX5CCA%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76ca98a1a8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22738,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (22666)","md5":"c07601c9dc7a051f684ada8b5a588c1e","sha1":"10b905cb285468743b548c66ec0a54f7204ed392","sha256":"96f235f5991ceb8e21a80d7090eced3d3792b451b52e3614713a07e23d1d563c","sha512":"d14baec3781b4ad8aa2b284184d7d02be413ca75df4ec69f3274f1acaa1dc71dc51f552a5e0d8dc74ae0f4326031512a11bd53bf90a6fd869493f78ba7810ea7","ssdeep":"384:B13Cih5R93iKTtXSt/KrGriu46K+Lxz6PTElH0jlhpPtwo:B1Siz3i0QtvTKiFSb2o","tlshash":"72a2c76a755034976323906ad10f7a0b31b21d24d7078128f22bb4be1dbcd99a2b7f5f","first_seen":"2023-04-07T18:53:04Z","last_seen":"2026-05-23T14:51:30.804389Z","times_seen":11184,"resource_available":true,"data":null}},"time_used":538,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":538,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/fonts/linear-icons-font/fonts/Linearicons-Free.woff2?w118d","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:58.202Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /app/View/User/Theme/DreamYi/Assets/css/fonts/linear-icons-font/fonts/Linearicons-Free.woff2?w118d HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/app/View/User/Theme/DreamYi/Assets/css/fonts/linear-icons-font/style.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:58 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 21780\r\nlast-modified: Fri, 24 Apr 2020 00:53:00 GMT\r\netag: \"5ea2386c-5514\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\naccept-ranges: bytes\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U2p8Wn0mR6BmAyJN6DhmTeXPVaD7fVIofU2Zk9tKBAf2v%2BXahSDvFpyEIDzCVLISnVYz3PdWGW9DfxHcAGkXWStqWtxgI6TiT8Op7A%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=4,i=?0\r\nvary: accept-encoding\r\ncf-ray: 9be76ca9ba1f8be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21780,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21780, version 1.0","md5":"03e91f122aa5fd425abbe23c85546eb0","sha1":"c87a3db06c5db4e75e639382f174eafa439aeb27","sha256":"296945e5922e764eef17b1b4a3ee3e60dc202b3c7f074150b62158915bf74e33","sha512":"d551461a9767cda29ecd44e381596dc6948f0123c5decbeb1dc9b1a20a7adf7911d67ff8457891442779e0cc3b1fe66456ffc7034e624cd8b2d7a020583c66c3","ssdeep":"384:rDy+B9/t2wjYl2hTxw7o6TEs9MpsAMFddYKDYpe/bjgq:rD9jsI4qs9MpsAUN","tlshash":"8ca2e1a285cd0cd388dbbe467493c42da3ba1500c306cfa9f54a5e6914b9ea7df0cc5a","first_seen":"2023-04-07T12:41:33Z","last_seen":"2026-05-23T16:36:05.685408Z","times_seen":9681,"resource_available":false,"data":null}},"time_used":355,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":353,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fanemail.icu/user/api/index/data","fqdn":"fanemail.icu","domain":"fanemail.icu","tld":"icu"},"ip":{"addr":"172.67.140.56","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://fanemail.icu/","date":"2026-01-15T18:26:58.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"fanemail.icu","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Dec 2025 10:02:34 GMT","end":"Sun, 08 Mar 2026 11:01:07 GMT"},"fingerprint":{"sha1":"D6:76:A4:E8:E6:1A:C1:5D:8E:4B:9E:D2:A7:43:6E:01:EE:0D:84:A4","sha256":"7A:D0:AF:F8:41:1E:25:8C:56:45:47:3A:DA:E4:FA:CD:D1:FB:9A:DF:37:A2:6C:C5:D0:C8:6C:27:83:20:B0:DD"}}},"request":{"raw":"GET /user/api/index/data HTTP/1.1\r\nHost: fanemail.icu\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fanemail.icu/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Thu, 15 Jan 2026 18:26:59 GMT\r\ncontent-type: application/json;charset=utf-8\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: h3=\":443\"; ma=86400\r\ncontent-encoding: gzip\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=l%2BjQ8%2B%2FQ4FNZc%2BRrM3QQUOxL4H6E%2FsEfEEm0mG88zD%2BN9M2E%2FWMxIP5U7hDNTD7ZznfXdQip4aR5BUn16ILF%2BLtKJmUby1vwx9HsEg%3D%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9be76cae3ac18be6-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":485,"size_decoded":0,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"23ff3a219d65d86db4218141792cd92a","sha1":"01f434e1e8b140b1fca569f176131710b6de32ce","sha256":"9c55a11d47619154d2113bc747959cf33982206d96bd95bfff4d9a687937ae74","sha512":"89e836e26caddd96584714b4eaa72d1391d1b68a13259121bf347dba7c81631f9d7afbabd6e09a938821c026dadf203be5f106b049d1319ff688b7a35a8f3005","ssdeep":"","tlshash":"60f05c6369ac64fb75ea24954a2f77f2b49c5a8a4fc047f069fee26c0851835064393c","first_seen":"2026-01-15T18:27:25.113225Z","last_seen":"2026-01-15T18:27:25.113225Z","times_seen":1,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":224,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-01-15","alert":"Sinkholed","trigger":"fanemail.icu","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}