{"report_id":"6b9aefa4-6243-477a-a5f2-0f323c5686dd","version":0,"status":"done","tags":[],"date":"2026-09-13T03:05:37Z","url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":0,"asn":54994,"as":"Meteverse Limited.","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"www.qq071.top/home?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"title":"传奇国际 - 无兄弟•不传奇","dom":{"size":346676,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (52885)","md5":"0e76013530bf7d33b97bad167f3c2697","sha1":"9a44d476e2b91366bcb64868c04ffc4231b00b79","sha256":"fa5629b28b92a1562e178c9ee0ce600c07ac50d9e90eaf243fb14e9198b05392","sha512":"43c05c17fd7fcc9f5464739242b8ae7db5a0687ec0b522f84b7cd23a6d8bee1731ad4a15b34ff191fa59c93ad0e9209e161918e28e3047163eba74d4d5ba2b13","ssdeep":"1536:/oweiF6yhsFQoZM/MyVAsvuLH1vBds2QQwof8S0DcznVLZllblike9EK9wfXHuqE:FmmMyBPRPI0cCTNu0QF2Mg8nQ","tlshash":"f374033061316a57043b92f4a0a6fe8970b3d70ddb67de442bec91a67bc7c70ac625e4","dom_hash":"domhashee2cc535d1c7200c625ce6b1a7eaa0a6","first_seen":"2026-09-13T03:05:55.473207Z","last_seen":"2026-09-13T03:05:55.473207Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-18T03:05:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null},"summary":[{"fqdn":"api.a8z2.com","ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2025-04-16","domain_rank":0,"first_seen":"2026-08-30T20:33:52.690548Z","last_seen":"2026-09-07T04:36:44.946773Z","alert_count":0,"request_count":25,"received_data":197122,"sent_data":13785,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"hlist.s3.ap-southeast-1.amazonaws.com","ip":{"addr":"52.219.184.14","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"domain_registered":"2005-08-18","domain_rank":0,"first_seen":"2026-06-11T02:30:13.286578Z","last_seen":"2026-09-06T17:57:43.292592Z","alert_count":0,"request_count":1,"received_data":2651,"sent_data":493,"comment":"","tags":null,"fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]},{"fqdn":"uapi.9tudkcx.com","ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2026-06-04","domain_rank":0,"first_seen":"2026-06-11T02:49:16.118215Z","last_seen":"2026-09-06T17:57:43.009429Z","alert_count":46,"request_count":46,"received_data":112594,"sent_data":29307,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"s.mng28.vip","ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2025-11-14","domain_rank":0,"first_seen":"2026-06-14T20:28:12.883545Z","last_seen":"2026-09-06T17:57:42.028944Z","alert_count":144,"request_count":144,"received_data":9183987,"sent_data":81676,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.qq071.top","ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":202,"request_count":101,"received_data":8176580,"sent_data":44203,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d02ccff24ffb9221a246599f1362487","sha1":"a87bf0e0ee510e2457bada7cc44840410df880be","sha256":"dbf82deeaa00c0a8d77d42a70209013cb7d6f5c6fd816379eb677b108c34d77e","sha512":"a65bec108a411f68cd909fd465729dfa32e62de4a4f7cabc10f1dd86d2c0bff6aa67660b91588965d13625dd16938bd1571841029d61aceb4ac9a4633c7583b4","ssdeep":"","tlshash":"e2e026b92104100a466f02b8e083db9835332033a270a420be2d81640f62ebf01228cd","size":340,"data":"","first_seen":"2025-08-30T23:50:56.159451Z","last_seen":"2026-09-13T03:05:55.822573Z","times_seen":140,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"2bba6ce44d1e04fbe0ee5169347c5c51","sha1":"6cb09f9fed5176a20e2495fb02e8b61c1985ec00","sha256":"94d090214c256a43653961e93909df3c14c7db687ceee2ab4b698084dc2d8518","sha512":"2564f440230eb27de9711f9b2e88568661ddb87bd6cd2997e5fd51cf106a9f07397a61b79a4a1d9caa747884585ca6e7312c8a8122ba63f8d38cf12bee6d29ba","ssdeep":"","tlshash":"20f0398e002a0609559210b83d6373187133605a243d85007e0cc2163f9ab4fc6a6bcf","size":443,"data":"","first_seen":"2025-12-11T02:11:47.421292Z","last_seen":"2026-09-13T03:05:55.823456Z","times_seen":110,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"97e39f8d51552b180054638f818f8265","sha1":"ad6a4859c2e0f0d23121079f8ce6f58a78677bde","sha256":"8fa1bed666f87618556653d0d4f1a107b71317ce4750bc0c30aeb66fc3e61939","sha512":"0cbbbe12690b0ed59f1e7eb01d5939efb6ac50ccbbfb025a6990e57967ee0d4b1bfe20f6bf26ec9f986f88eac8689b4139c38cf52783ad36a5c110c211af1dd9","ssdeep":"","tlshash":"6811ad1824ee160c81177a95b1bfff4c762c512561e4dc0c814dd075182ddbed6dd99f","size":1077,"data":"","first_seen":"2025-08-30T23:50:56.16459Z","last_seen":"2026-09-13T03:05:55.824195Z","times_seen":140,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"62d8ace796e74f5c67976c32ef3e4ce1","sha1":"c1e865c2455a6ffbf4da39e41612a903e85b09a9","sha256":"64bd2b01a49fe824a05452f16707b70602bf66387f4ab57e6dc4b58b45b22ddc","sha512":"748a145df14ef8684d955961d04c14cc39316703c3e267c7294210a4e881e8970ed33ecdf3d092e96a4dd2f0e25651654f75e2933607c14672a1adcdc69d0add","ssdeep":"","tlshash":"56f09e1b1c47b1ae1bd6a17aa73f9d1b22112146319054137e0c80286fe083c5fe9e8c","size":518,"data":"","first_seen":"2025-08-30T23:50:56.168428Z","last_seen":"2026-09-13T03:05:55.824978Z","times_seen":141,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"cd7a34e714de94d5c29b8ac5acdde24b","sha1":"b722bccb435490630d97ef88cafeb02d92f70fd0","sha256":"312ebfdc50a0e168cff60c206811b02e944263a7d9060c2685509dacfacd7f71","sha512":"a724bc648a508c24e5bb1788e1f02b47030893bbb0b80a99e380d95480095983a35d8ec11193c53f0a67db47a289ab608fcbc9dbca846bfdd5d61a8832290f43","ssdeep":"","tlshash":"58e07d48ff28c7f316ce28ab516e770858d104d58c1b58024cebccc86935ed87291527","size":314,"data":"","first_seen":"2023-03-11T11:23:25Z","last_seen":"2026-09-13T03:05:55.825651Z","times_seen":42640,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"528dd01eb509d1fc3c68b48e165c9d77","sha1":"8d702f33d869eb8c53cf75c17014f96385322395","sha256":"b508dff20bdbd9138e31aa48c45bc501805e509d2fd4709b39c4a60cd5c6b43a","sha512":"4c1edeec560f431005363ff5291acc80c1c42edf7c9a6d6e4fde2f7539b6a35a8e36f0bc228503263277bf5df4525dc579575faadca614c32e5dfa885a2d343b","ssdeep":"","tlshash":"78a012bb71b851710cd51ba7a40455e01c20123105052c101c8d5151c011c171d394c0","size":84,"data":"","first_seen":"2023-04-07T06:55:59Z","last_seen":"2026-09-13T03:05:55.826377Z","times_seen":43987,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-Nlp_YWaw.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d446a3dfce3e0dac112b0f8434ebfa1f","sha1":"f389ca9610e30de3e6c25f8d481f17462004d8a7","sha256":"8d78d61e45b8cc41f32c2846e7c056c114786667c71f4ad539fccc3f34fc824f","sha512":"4986b4c3f0ca24232e39911138d2fb474889120f62f54e50a98d47c3477415447c998a2b8f52e0a59b94e0ffd7cbcc05fb1a520b9d5546ff65f49bcad7509239","ssdeep":"98304:734X8XWkI/9DDmCtjXnV2WlPYfoUEG33SHLqNyC+kg:GHLqNyC+3","tlshash":"0c16c690f487a49153da8a946c6f18d5b2584c867884ac63ecf9ec09fdf1cb2c677f18","size":4202137,"data":"","first_seen":"2026-09-11T22:02:29.780053Z","last_seen":"2026-09-13T03:05:55.827648Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/autoplay-VoH1CCKZ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"fceaa5faf4069b65026509da2f0f296c","sha1":"8dbbd7d51b1c092888746d474b2d30c8fefd02f7","sha256":"b633fabc078ccfd129584d566519994ee79960460c8594b2dc869af2064572ee","sha512":"9e44ea8041c4a4892c4917c32132a253af24dabd9e28bd8019f362ec1acb5d9cde4d27a801f95a6fc359ce6ba2ca7d286031db687e36b686feb7f0f0fe81b16a","ssdeep":"384:HFWg5jvHRISWvwv14ZMYRlGuBn9XgpaU19z:HFWg5j/RtW4SZFYuBn9XgpaU19z","tlshash":"4052839e120672756bdf06a742f84690e7700445f00dae7c70fa8dae176ecc90767bba","size":13296,"data":"","first_seen":"2026-09-11T22:02:29.712909Z","last_seen":"2026-09-13T03:05:55.489098Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/sport-CYkldf0t.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"39702f3b369f9d1a8d60ac05517caa20","sha1":"e556d3cb37ab5fc22889b168fa58a84ab7b6d6a7","sha256":"6e7b538d5d0d68dd48b6a150c9c28486bbc0b3438a4004f8a3b1112e60218219","sha512":"2d7e7565a3fef8461e8c1480568f19f65b38a6321921e6483162186ce9fee1b80e8beee4727c0f9306c6f7e639b7923b619481d8f6f2dc4b5fe70b6e8756001e","ssdeep":"","tlshash":"99a002011502dca1419c25d58231c68234405658615b615981548a89e8219809506b24","size":59,"data":"","first_seen":"2026-06-14T14:24:21.536566Z","last_seen":"2026-09-13T03:05:55.621081Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/js/gt4.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"caa99974e6a31f8140a3f0eab55915f7","sha1":"c8f6a70abcb986d6967426705eb8618a2c9c6706","sha256":"4fac342952d10d08f4de1b3eb74dbcbafd159cdbb7cecb54b50192ffb93cdabb","sha512":"7251459bd17be8bf4ae2487696bab74354bedef92fa3e4a1784e8dca825e0b734b267eb2c5b45d8cec478c3b17d8dbd4bf7f295938a244a5d39ed60e905bb2ab","ssdeep":"384:fcxFHiJF/PSZwluURGW/aD9mtKwDwF7QYVqp:fcxFHg5C9G2Dc","tlshash":"c162524e68f750a34563b428cb9fa124b9788a53002cdd41bd4ce3589f9447c9bbafdc","size":15208,"data":"","first_seen":"2025-05-10T01:30:52.271288Z","last_seen":"2026-09-13T03:05:55.480898Z","times_seen":127,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/useScrollNode-C52eswgQ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d5ef37a6ed4c7b646882fc732b90560e","sha1":"a0c37fb2ad9850f139d061fb43b9f64299d9dbda","sha256":"1820fa35f8a83a557f5134391997af7e129ca75afff7cd3e445d917069cd8c29","sha512":"3dff836204a2fae68ee972906914aef47abca89281c2a46c1a0aa3e989288e6289b0c097cac7f82387db7f8c2f3d68d0b617541243761386c600e0f01df4425c","ssdeep":"","tlshash":"0ae06198334a0230a2bd1582552f1d0d25116ba167db91d00509c8bb176047dd3dbf4f","size":378,"data":"","first_seen":"2026-09-11T22:02:29.536876Z","last_seen":"2026-09-13T03:05:55.688938Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/useMatch-CsbJn8Wy.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"84eae6e9bab35d132e69f5501105c29e","sha1":"4b1273694606cb00e644432998fb879b33428448","sha256":"2ed658bd356979db216ea3e327c2951a5b665a51336e704e6c5dc98fbc0601f0","sha512":"4aa4a8233307fb04db1716caed7c7af98183f314ffe8798865867555a2acd862735e9262dfb9c51370eda4a4987cfc229173727b7abd32e33cb4fbf00cdaa8e7","ssdeep":"","tlshash":"f361148db26628647b774c8a402b0a93b35e6f037df8a5d0445f7e722335d095391a3e","size":3420,"data":"","first_seen":"2026-09-11T22:02:29.450382Z","last_seen":"2026-09-13T03:05:55.76304Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-09-13T03:05:55.828387Z","times_seen":755649,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-QhTG0TiH.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"a6d083fde87e01ef073867973fc48e76","sha1":"22ac08a7ab429c578d5ba903c75eb1e5c5e2af17","sha256":"d143ad94cf4375911288c229865447dfeeb23ef38ef321c7891742cc17cbb05a","sha512":"fd44e4a889700ee4275129975ecc4e5a00d447706c55b01fc6e999a07188e6885a8d0518e1a200b63ba26f522469a1001666091a6fa2bc67b5449a081db031f5","ssdeep":"96:SY0V1VXWR5ya5+wn9sRzfEwiz02YHkNsHoUjH:SY0LVXWPya5+wn9ozfEwiztYHkWIUH","tlshash":"1e917308ba4934b3473b4b91942e4c1582ba43d8e8d798f2b15f8d582affe5532ce6d1","size":4547,"data":"","first_seen":"2026-09-11T22:02:29.37858Z","last_seen":"2026-09-13T03:05:55.747153Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/MarqueeText.common-9LvoYRLZ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4e0f1f09aff3d323e36884762b516239","sha1":"a76fb315b716b15a91e38597cc76aaefb09f4189","sha256":"2d68d2caf842803c0e8337ff344e862ed18f43382e502525852779b708043dce","sha512":"585eb2f8973742c59c7533bacd2f769047ca7a1af91381e312b3b5fb9ef4cd084ff99b0996fab22fdd80b30643ad32f7c763321d6c797e1241e98c7ffc444574","ssdeep":"384:rLZ7w0doJZcOYTicwYqBFzxB/2n7aJnRN2wyF4HlckQc+dS3H29X7a3:1EZctOcElBe+M0cMf2F7a3","tlshash":"4cc2c69975c0b87543e360ec112fa08ab1f60a54b4aeb8d0f357c5d46ef898d6127f2e","size":27541,"data":"","first_seen":"2026-09-11T22:02:29.452544Z","last_seen":"2026-09-13T03:05:55.718199Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index.vue_vue_type_style_index_0_lang-KRK6zDtf.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"fcd693ccd2bb4288c64bc2cf91a6b06c","sha1":"3d6d7c464db08108f533b8d762ec9f822a882b9e","sha256":"7f523c17f64c44cdf39b995d687e2a37118a391334efb45c16d567e62d1be502","sha512":"62e8701741fe133267f72371d1a19947b832c0798801cbdb72c23a1492b222d7c1425e2b74d306a42084ecbdeb1a40720e5549c242c0b9f37a3f4ea568cdade2","ssdeep":"","tlshash":"e83186acb51db0f8e273146448301437a2772e2cb025fa0102ec0d5a964be2c87dcb25","size":1684,"data":"","first_seen":"2026-09-11T22:02:29.478732Z","last_seen":"2026-09-13T03:05:55.513535Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-CCXActYZ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c9ec82473b150dd8c13917df92b349fe","sha1":"387d0b2621b45f19d2937538f1e4cf850b5f0152","sha256":"168a1cacda321395570886cddfcdfd5203b76c8a709ec745387fad7b2e6cb0d1","sha512":"b7e375a578ef5218fc4175fe268ea1a5e8a6fee40ab44fb0ed981bb1ac112e0320596b9f30c2b9ab99094cff587a31d1e9fa1bbc0c063dfbb3753aa06d5896d9","ssdeep":"3072:orml5OVXlH/fi1xRQpfmiFm8hqpRi5sfBP/ml:gmjeXly1xRQpfjFm8hqpRcsfBP/ml","tlshash":"c0b32b48785579378a7b04d5809f0c05b3780b8dd42499d5e1bf9a9c3bcac247bafb2e","size":116270,"data":"","first_seen":"2026-09-11T22:02:29.667745Z","last_seen":"2026-09-13T03:05:55.795012Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-CixQeApu.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"918e080b4e39b3829f76bd1f9adce2ab","sha1":"2c02aea3d2d612778ebe2d2c1308bfe11aa02d97","sha256":"1d9697b86040c04bf1927025326d2cea8539381a5810ed0fc794389ccf4bc04c","sha512":"a66fe560b44a604e59126a6cd74bb568645f50dbdedd7c2b7f9a05149752f0383da61e40e495629a4c73b0d80c014cdaedb1b9a18331fa4ff5d0888d49524cdc","ssdeep":"768:Jz0Ze8lIN12totQJemLVYNExYYtS1ClC4F/t+/tdm2Am2AZoZhwjY2JnFA/at+RB:Ca2tot2e9NcwU8hw7csGvQB","tlshash":"5d831749702a5abde2774568b0ed5809720cefc6e141cda6b0fead2237d2c75879c738","size":88693,"data":"","first_seen":"2026-09-11T22:02:29.346728Z","last_seen":"2026-09-13T03:05:55.766987Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index.vue_vue_type_style_index_0_lang-CRb-J9Dl.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"7aa9ad50da5f062aed4b7b3faa51d8a1","sha1":"d7c4c19db937ed71a957b97f50790936936eaf42","sha256":"12cfba58d065c3ed76e8854ee887bb42aba7cd89ab5fb0f0f4e1dd0afdb1513f","sha512":"f8326b318bf8405a57a8e56e20c727c89793730e0b547414d02673724f55c018c0673fb118d2ccd89ad5667aabb3c13a46dc6f0d3608b4f5120abf33df2c0b63","ssdeep":"192:johPHsg1+9qJK81ndhg1JUY0gEAdJyBG3oOb8QXY+nNRdJI4eX/5A6Do:johW9j716aPyeJTxVId5RDo","tlshash":"f732f80ca071493ca4261049656d4a4a620e7fe7c29984d1f1ffae326bd2ef477e8329","size":11535,"data":"","first_seen":"2026-09-11T22:02:29.718033Z","last_seen":"2026-09-13T03:05:55.716035Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-BgXo_eUf.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"cce1f32181a75926a281e067006b748c","sha1":"e2d6242c367d1f7ce63d959373db58698659d2eb","sha256":"214d16c145578c59161c64995026f3ae23162c5ba0765c2f6b176804d13fd04d","sha512":"74f2eed1ef0244a7955034642e54d63433853aeb2108c9f276129e2f8622510cc4005d62e224235e264922d72a49a1f0709b67a76a57bd7a5c792483a60eb04a","ssdeep":"768:dZRBdHnvomPNehOTDLOY72qB2USjTPqB0S6BptkVJR:dZDhvRkaLD7TB2vuREp4","tlshash":"3203e7e432b1f186a7eb28f151efa046f2356d88980c15b5f10d9af93cb5581b72af34","size":38151,"data":"","first_seen":"2026-09-11T22:02:29.443808Z","last_seen":"2026-09-13T03:05:55.787287Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-DE4r0nPP.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5568fd2eaa670f97b4754e8a1fdd6436","sha1":"f4a9bab03b3d3c611059e338903bee660b978bbc","sha256":"904eeecb84ef95667657bb79e748a939c5212af9bea5c36557427d83897392a0","sha512":"f7ef28cdb0d07e85be9ab0e9a91b21aec230b0f1b25d09539c48b4881466c2a6b2451c0302bf85064e9f48fa6fdb859e7f727ac15eb94d854cd0c51b41a2b21e","ssdeep":"96:5oTgIrfj+EH3HATGtexAyDIFtBIHIDQVkwAV5tArPda7NHt7aLtOve:5mgIXP9kHDub61VkwAVvOIxHZYAve","tlshash":"e191b9957598747f947b00da609f8451138423d9e23480d1f3ba7f29379e9e02edab27","size":4555,"data":"","first_seen":"2026-09-11T22:02:29.490408Z","last_seen":"2026-09-13T03:05:55.670132Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/swiper-vue-wuF8Lk5Z.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2d460e9501dfb31b559fc38da47abca7","sha1":"b2a1efab528de8f7aff7706da8a19489d0dd74e7","sha256":"d6731cf296d85f85ce31db143d716a7cc491e02a6c78b9c6a678423af5c9ce8a","sha512":"3c1eccc2bfcc09770876f833310da9a0b776f9799a3bc1cd751770c42c8f11815690b15cececbb8c9b6ca72164359953ebbde7a44372d0b7f18ce8260f8a8780","ssdeep":"1536:tEo9IEmlUJD28Qv7BH0/PMLfF5pkDsSbC9mLKBlxvH5u98zkYXiA6wZ9//PSL/kJ:ao9rmU/PMLfGDjsHa2","tlshash":"9f931989b224b17742f759da9375c20172a14d44b849d8e4b0ee8c7b496ed5c03aeffc","size":89063,"data":"","first_seen":"2026-09-11T22:02:29.639585Z","last_seen":"2026-09-13T03:05:55.781559Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-y3yWNOcx.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"ae1be571044ffad688f8901190aab953","sha1":"7b732dfca8ae0ce06ff8639bee9fb05d9a706ff9","sha256":"c1073428906f205323cdbddf3a17526b10f1fa5d25472453cac1b3be7e0af4dc","sha512":"5f3862f6f3a8567c7c9ce81ed5fc7b0c488d70bca4975f7c8c901d4b8a88bc2e1e21cd4fde390f27d5792ced2a65ed14834faa44b773164500822d07077aee1a","ssdeep":"","tlshash":"8381f8153ce9747193768887c0e70608e7796339a23ff8dbb789834138544ef974262a","size":3876,"data":"","first_seen":"2026-09-11T22:02:29.691579Z","last_seen":"2026-09-13T03:05:55.567317Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/gameItem-CEtmq7uS.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"922a20c47219fea690cf2daea66ea592","sha1":"5f9f53198dde7c8b5cf374f2724bc644768c5583","sha256":"3f9122c9744799cd335e5bb617656db887301438e535b21c878aea9347f307cf","sha512":"43c3cec9bad6173754bdd5aaa66c53a76907b629aca70fa20c3cc1f3e6394d8eae618e8333bf715bc0d5d3c262bf8a69692425c6b48d475d1c1f9eae89205848","ssdeep":"","tlshash":"0b71746c2153967dc47b25e4106c700a913cff1afdf9ea4aa1b9f07d3b805b49365b24","size":3819,"data":"","first_seen":"2026-09-11T22:02:29.524825Z","last_seen":"2026-09-13T03:05:55.484413Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/option.vue_vue_type_script_setup_true_lang-BXULlH9N.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"61433b4de1ca3c292aef64962abfe8a8","sha1":"be3f48d9205b836ca25a8e7084c815d3594309d8","sha256":"69ebebbcf8f9cc30ccf43d4c94d6aa8251c2f998d11ebf74b0a179abb496a813","sha512":"8adcbc282e5dcc24a7fb89e9566b299562b4bf3a151391069346662e20e1e134b719ad416f9be239a94f4ddf95bb7ca2d202c4641c204a387e298130014ee538","ssdeep":"","tlshash":"4041b7fe5695c46240721350e678a89422dcf5c8f611474a73f67d215d85db1332e6f4","size":2218,"data":"","first_seen":"2026-09-11T22:02:29.337993Z","last_seen":"2026-09-13T03:05:55.571166Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index.vue_vue_type_script_setup_true_lang-DAkzcQ_D.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2ff2059283b87d1cc3bd6853d0e48908","sha1":"5470a617013516f663098124f93adb453c6a0d9f","sha256":"92048259f7dcfde65381428c62570bbca34ce13a68e3878baceefea8c472e7c0","sha512":"3a8dd96893302f613a634b12bfc63200085f9792c546a6bad573b7d160b85949560863d544ca62321310c960e68213daff4b647c6e1db47b1d0789778b866424","ssdeep":"","tlshash":"4931668eb812c63ce19710885cb85915a15d7efcf0b59903a7ee84472792872ae8a75c","size":1738,"data":"","first_seen":"2026-09-11T22:02:29.465425Z","last_seen":"2026-09-13T03:05:55.768988Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/game-99j3hAkJ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"5b8b7569fd7043aa81797b66d0c18353","sha1":"f7bcaa6920de97f0e6660f8655dc672acbf16a54","sha256":"df6874c8321419d3e0a577e002729a901279817d2a22b9cf597f4391ba4ccb11","sha512":"4800563340f6234c6bef8aa7ef56dcdfea507cefa6b791b97a93ecaa599b033fe470d8198867fefcf8aacfbfc1896a40c670093ab8789b874703c7c2944ac636","ssdeep":"","tlshash":"fea00215141184a5016620418522e5c920046b88761671aaa2585e45a0628518446f39","size":58,"data":"","first_seen":"2026-06-14T14:24:21.543491Z","last_seen":"2026-09-13T03:05:55.614278Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-CoxNcPbx.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ca49c0d4da220b1824ac69d478d8a98","sha1":"3ab7fff17690ba444adaa0601d892bbeea07ea1e","sha256":"a5e494fb4d236d926ecb8f93be3e082c30779401b2d91ecdf6dda7c28367d54b","sha512":"57b322e680c0b15603829752e3093a55b54fb6f99779f787db635f240fe5aea8f623e3c49254f726a69d73ad87401777e6d29cb18bb28987cae0861305b7c391","ssdeep":"96:ADN4lU726n2dL/e2fpSmhCjhFfsWgwuZcPbqT7ytZwNsMjt5:UN4lU726n2dLmipZufHgwnP+ytetZ5","tlshash":"60d1c65274dcb577caaf8072902548b0a33407dde41c87fb53b4672e2e8fc6419e6e69","size":6169,"data":"","first_seen":"2026-09-11T22:02:29.370716Z","last_seen":"2026-09-13T03:05:55.696749Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-BjHNmcI8.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"966626f1d60f43ee66e6a26e9f431f8a","sha1":"47c144de4cf32aa987cbdffab9a9b03540c4d8f8","sha256":"388669616654fce39665730923a61ebab9e946257799d4f5fda1cda757055d14","sha512":"73d17fc246ee6b966cccf48176e7794cc96ebd4ea0ff608cd939c155a12967ea450548a4d2dbb2c46826e3992ea2f7d221750393ed6ada21ab745bb5dbc6ffab","ssdeep":"","tlshash":"341112c9ba111b39b4fb042da9583d15350e25eaa33c9c80b3aa1cac80e5b77434d611","size":874,"data":"","first_seen":"2026-09-11T22:02:29.318697Z","last_seen":"2026-09-13T03:05:55.778625Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/create-element-if-not-defined-BMi5bvf-.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b7e0c1906b67ada7c7d27c641da1e6c9","sha1":"e1d07129d2c850e2262516e14bcab3a3a9a2416c","sha256":"703997cc197eef36a7e9c033370bbd2bb0ae8bc6e02e4f3040ef632397222e67","sha512":"e4a7bdb339316b779eea4d900261ec962c803d08c7a233ec8dd7bdd7d99d532afd69c0e22827d80ccfb49a016492c6e9b0cfd3ca83ad267e8ccdc404e6c57a59","ssdeep":"","tlshash":"05d02b595033907409fe056e04da5e07e15366ba272157147063df7496e89e28a0fd0a","size":276,"data":"","first_seen":"2026-09-11T22:02:29.348419Z","last_seen":"2026-09-13T03:05:55.800211Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-jtbDOXiO.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"990074a82e7d091fa39b368efd742c29","sha1":"7624675d03bcebe2ca31a3a40af3285503b25b2b","sha256":"cc46db07cbd76298e53d9bed2d167f0722a5a666d298f975fe3c4cecc834f7f7","sha512":"dd6ee6e1bccb0b2437e832dd3515c7a5565826117dec9a66e219da0125139928f3111b4e36d33a4330a2b95c64af6987f6ac4a279fb774f2bec75188b792c602","ssdeep":"192:bQ3IRB2AswfH4O3pXLB5HU+oH09bQGQbl:b9B2AVv4CpXFFJoH0iGQbl","tlshash":"ef02f88835e37136c67f01b0a06f861563b91ba5e41c85e8e07e77192c5ccb8a3eb64f","size":8886,"data":"","first_seen":"2026-09-11T22:02:29.70492Z","last_seen":"2026-09-13T03:05:55.770392Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"hostnamewww.qq071.top","filename":"http://www.qq071.top/assets/index-Nlp_YWaw.js","line_number":22,"column_number":49405},{"level":"log","text":"S3配置解析失败can't access property \"importKey\", crypto.subtle is undefined","filename":"http://www.qq071.top/assets/index-Nlp_YWaw.js","line_number":55,"column_number":41488}]},"http":[{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/agent/supportActivity/entry","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.796Z","timestamp":1789268705796,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"POST /uapi/agent/supportActivity/entry HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268705\r\nx-cq-sign: 160905e66d9ea1e163a43b55752a6be33d5fe17f0a8cdf8fe70d7964f4e95bc980ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: f7d1499168c2d41858c63c29283b94c8\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:35 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_2046-65483\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":160,"size_decoded":856,"mime_type":"application/json","magic":"JSON text data","md5":"13501977df741621a426d0e8092d8611","sha1":"8e6c4a5f92e74f41196787130e7a5054f882ecb1","sha256":"ae2de0b587de0a1f1c45266ee3d47d5ba1bbbeb8efa4e8bc72257f298d03370f","sha512":"48d7848fce1e859275e4219d4795463d7358afa32cddf07c10af8ba4c76d52f897024046dea525b114d1b9b67b472a444ddfd132685863e759aa4bcb6e5d5019","ssdeep":"","tlshash":"83c02b8010347cf8f30303b4923f51379b80244d7dee5103d8ccbe200006020d709d1c","first_seen":"2026-08-07T21:06:08.234416Z","last_seen":"2026-09-13T03:05:55.476815Z","times_seen":35,"resource_available":false,"data":null}},"time_used":202,"timings":{"blocked":10,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/msg/indexNotice","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.824Z","timestamp":1789268705824,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/msg/indexNotice HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: da87618d68c2d41851c63c2917a76c18\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_55446-4886\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":539,"timings":{"blocked":360,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/fbHotMatchList","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.362Z","timestamp":1789268707362,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/fbHotMatchList HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 7d5c552969c2d418f2a7b35c70e2392a\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_25562-30865\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1551,"timings":{"blocked":1363,"dns":0,"connect":0,"send":0,"wait":188,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7iatvzhbs14gqmol2b.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.215Z","timestamp":1789268707215,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7iatvzhbs14gqmol2b.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 90861\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:13:47 GMT\r\nETag: \"fbc32f1e73e7d3ea1d795db6834fa5bc\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2133\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":90861,"size_decoded":91293,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"fbc32f1e73e7d3ea1d795db6834fa5bc","sha1":"370cd5fb0e836a729f340b8280af206a899ffa27","sha256":"fc240081019ef67b8bdb6f22289e128f94b5882cbe6f1bb0fa544c58413b236e","sha512":"d1ba4872ddd3df5cf2f595855f47c32639a4f7b67845f6e257a2c032b9addd533e7d84b258a30f4903fbf8234f050ad788db7c0c065ed4d8ebb65ebf43d26a53","ssdeep":"1536:2/k7c76Nx9GzWCeSEq/B0egC8RU+P+e+VpN2S25rHpGsLRmp0:DcDarSEwELR7+h2S26sLEp0","tlshash":"6993124c36bb96b12e08361fddf3652348ef739491e5b20819325887152bf065dfae62","first_seen":"2026-06-14T20:28:34.015413Z","last_seen":"2026-09-13T03:05:55.479652Z","times_seen":37,"resource_available":false,"data":null}},"time_used":974,"timings":{"blocked":940,"dns":0,"connect":0,"send":0,"wait":27,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/js/gt4.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:02.461Z","timestamp":1789268702461,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/js/gt4.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-3b68\"\r\nExpires: Sun, 13 Sep 2026 15:05:02 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612de_PS-CDG-04VRO197_24105-30043\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15208,"size_decoded":5364,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"caa99974e6a31f8140a3f0eab55915f7","sha1":"c8f6a70abcb986d6967426705eb8618a2c9c6706","sha256":"4fac342952d10d08f4de1b3eb74dbcbafd159cdbb7cecb54b50192ffb93cdabb","sha512":"7251459bd17be8bf4ae2487696bab74354bedef92fa3e4a1784e8dca825e0b734b267eb2c5b45d8cec478c3b17d8dbd4bf7f295938a244a5d39ed60e905bb2ab","ssdeep":"384:fcxFHiJF/PSZwluURGW/aD9mtKwDwF7QYVqp:fcxFHg5C9G2Dc","tlshash":"c162524e68f750a34563b428cb9fa124b9788a53002cdd41bd4ce3589f9447c9bbafdc","first_seen":"2025-05-10T01:30:52.271288Z","last_seen":"2026-09-13T03:05:55.480898Z","times_seen":127,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/right_legendary.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.784Z","timestamp":1789268705784,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/right_legendary.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 9631\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-259f\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50640-6034\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9631,"size_decoded":10274,"mime_type":"image/png","magic":"PNG image data, 71 x 90, 8-bit/color RGBA, non-interlaced","md5":"7300bf00173a93e48b0584b28244d213","sha1":"fcd5531448552521093f2e8d69fb4eb67ad637b8","sha256":"ce70075b753efa5b72154a297507d0adb684e471219f1350be931af508a95787","sha512":"f4d2f370388f6ce6e07b30bccecd644fd23e81d238e99e41ed571c3bd7e2b1de3376b2a002c81974108c574638c3e5a5f1f442f3f5b099c5b5ee7c10aa15ca5e","ssdeep":"192:jSZf97jtrs/l/3Q7CEiEuF+WGiTPewWQuM79FkfCULgh6n:WZf97ja/l/A7CvE6tT1WQ5FkfC2gkn","tlshash":"9a12afb5a57de077e8364e3393ca95406717aa66463e839a98ec200c95c0dbd09b9a43","first_seen":"2026-06-11T02:30:28.047548Z","last_seen":"2026-09-13T03:05:55.482114Z","times_seen":70,"resource_available":false,"data":null}},"time_used":1360,"timings":{"blocked":1181,"dns":0,"connect":0,"send":0,"wait":178,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqfz4lqtdyeq0dypgdx.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.846Z","timestamp":1789268708846,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqfz4lqtdyeq0dypgdx.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 2009\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"0f85788e7fc7713b5eb0e3855aa1ed65\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3248\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2009,"size_decoded":2441,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"0f85788e7fc7713b5eb0e3855aa1ed65","sha1":"33b9db551d90ab58e51d36b09ada6997d687b4cb","sha256":"9164d289ada08568668268a61c83090adec54fc7976af5bad250ef3c795ce6d1","sha512":"04997b5d4edc92a6e97ee81fb92e1ee4a25fc81270ed01a4124105eabe72a6d484920567ca92f7e26ec9e162d2a670f62a0b90145563184130a4c12919599e4b","ssdeep":"","tlshash":"d7412adab1bd0f20ff489cbd5ea34c18a2311e9dd929931e953ee43e5b0342460d2d28","first_seen":"2026-06-14T14:24:21.504175Z","last_seen":"2026-09-13T03:05:55.483471Z","times_seen":43,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":44,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/gameItem-CEtmq7uS.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.404Z","timestamp":1789268704404,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/gameItem-CEtmq7uS.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-eeb\"\r\nExpires: Sun, 13 Sep 2026 15:05:04 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_23850-31921\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3819,"size_decoded":2459,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (3818)","md5":"922a20c47219fea690cf2daea66ea592","sha1":"5f9f53198dde7c8b5cf374f2724bc644768c5583","sha256":"3f9122c9744799cd335e5bb617656db887301438e535b21c878aea9347f307cf","sha512":"43c3cec9bad6173754bdd5aaa66c53a76907b629aca70fa20c3cc1f3e6394d8eae618e8333bf715bc0d5d3c262bf8a69692425c6b48d475d1c1f9eae89205848","ssdeep":"","tlshash":"0b71746c2153967dc47b25e4106c700a913cff1afdf9ea4aa1b9f07d3b805b49365b24","first_seen":"2026-09-11T22:02:29.524825Z","last_seen":"2026-09-13T03:05:55.484413Z","times_seen":4,"resource_available":true,"data":null}},"time_used":567,"timings":{"blocked":381,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/userAppSet/self","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.416Z","timestamp":1789268704416,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/userAppSet/self HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 4bd12e5068c2d418dfa6b35c7b970fca\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04koU196:33 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04koU196_50987-6398\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":718,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":914,"timings":{"blocked":376,"dns":1,"connect":25,"send":0,"wait":482,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.955Z","timestamp":1789268706955,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 153\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":153,"data":"{\"type\":1,\"sportId\":1,\"leagueIds\":[17663],\"current\":1,\"orderBy\":1,\"isPC\":true,\"oddsType\":2,\"beginTime\":null,\"endTime\":null,\"languageType\":\"CMN\",\"size\":1}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nContent-Length: 97\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: 3b426f4bdb17b1640\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_28847-10789\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92,"size_decoded":595,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"e4662bc44588377e782fbce985062799","sha1":"2987db379501adc2e2bca61f781019807920c97e","sha256":"358d7afa85146a073a8eac196998feb68f56d889bb126b05f38eca84fca2db9c","sha512":"3a819045f743ff4fae408526cf42ee34e7681f99eb7603292ad3985da9667553775c2ff84ea69893380b9071f4c4e0f8c377386587965d1ee3c4f343591da958","ssdeep":"","tlshash":"26b01209440c0272f24191c5102b251287bb210a1d100a0089ec834c8d0e0092182006","first_seen":"2026-06-01T18:09:18.929363Z","last_seen":"2026-09-13T03:05:55.48538Z","times_seen":32,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/icon_provider.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.345Z","timestamp":1789268707345,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/icon_provider.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 1163\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-48b\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_23850-31943\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1163,"size_decoded":1806,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"b3963d3afb8fb3d6262467778833d0c0","sha1":"555502c7bcfd3c0fc89db41c5cc7ae4da6f384a9","sha256":"47142d971ca997c8e1ead32bf69fdbfd99e62121ab13c1006db5513baf04863d","sha512":"92bbcfeb7b137d1dfe845bd974e575e37d54db783d8d469298a330cf1279c854b7b3614172ab65cea2b0da83de7e18660303a051eac76d42b03b3b751aeeb25d","ssdeep":"","tlshash":"3f21c60383d3d9b4eb182c50e712d6213e0f57c50203fa9bdbdb8a9c0666da2893594b","first_seen":"2026-06-14T14:24:21.512716Z","last_seen":"2026-09-13T03:05:55.486788Z","times_seen":43,"resource_available":false,"data":null}},"time_used":568,"timings":{"blocked":381,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-13T03:04:58.334Z","timestamp":1789268698334,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /?agentCode=sxkngs HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00016.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.357Z","timestamp":1789268704357,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00016.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 25149\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-623d\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04koU196_50640-6026\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25149,"size_decoded":25793,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"6d4db153998e501fe28ad84de35b2f0b","sha1":"c0ae347844be97b395ab6ffe0dbb2448d2f2a208","sha256":"739358f3c9c7336fd11dbd0e50adb21d9aa6c4d33ebae1a969c8d7ad739c4638","sha512":"b842a2c915b6b4d0e89bc3eba7f1222f5a21ac92aabebfe1204d447f533db0f471a80820f4eb9d23ffa115476e2e3d6e4dd45877a522a338bc21f241ba3aa26f","ssdeep":"768:7cysJAhJdleH2tjYLL6wUg00uNqS4lz521yXbD:84JbBt0X6woXkJt21yXbD","tlshash":"42b2d05b4795e2caf722463ad4a47c31f345bfa01a299885d2bdf4a23e79937d2c0c05","first_seen":"2025-03-14T20:40:58.414381Z","last_seen":"2026-09-13T03:05:55.488014Z","times_seen":117,"resource_available":false,"data":null}},"time_used":1474,"timings":{"blocked":1290,"dns":0,"connect":0,"send":0,"wait":180,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/autoplay-VoH1CCKZ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.406Z","timestamp":1789268704406,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/autoplay-VoH1CCKZ.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-33f0\"\r\nExpires: Sun, 13 Sep 2026 15:05:04 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_24105-30052\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13296,"size_decoded":4855,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (13295)","md5":"fceaa5faf4069b65026509da2f0f296c","sha1":"8dbbd7d51b1c092888746d474b2d30c8fefd02f7","sha256":"b633fabc078ccfd129584d566519994ee79960460c8594b2dc869af2064572ee","sha512":"9e44ea8041c4a4892c4917c32132a253af24dabd9e28bd8019f362ec1acb5d9cde4d27a801f95a6fc359ce6ba2ca7d286031db687e36b686feb7f0f0fe81b16a","ssdeep":"384:HFWg5jvHRISWvwv14ZMYRlGuBn9XgpaU19z:HFWg5j/RtW4SZFYuBn9XgpaU19z","tlshash":"4052839e120672756bdf06a742f84690e7700445f00dae7c70fa8dae176ecc90767bba","first_seen":"2026-09-11T22:02:29.712909Z","last_seen":"2026-09-13T03:05:55.489098Z","times_seen":4,"resource_available":true,"data":null}},"time_used":598,"timings":{"blocked":420,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/channel/g9kdwd056cidior6unck5usqhrm3t1zs.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.174Z","timestamp":1789268707174,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/channel/g9kdwd056cidior6unck5usqhrm3t1zs.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 367889\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Thu, 21 May 2026 23:45:54 GMT\r\nETag: \"99bfbb6b559dfca694944b7a73df5113\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3228\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":367889,"size_decoded":368324,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 2400x500, components 3","md5":"99bfbb6b559dfca694944b7a73df5113","sha1":"0314961a78dcbc6c27c36cc9293447dc201a852d","sha256":"73e3a08816c6e2bf09031bfbb3d23bf56d8dd8f16d838765938178c15eac49d9","sha512":"68a13d626ec0894c606d6891ca7deeb21a2ddb76da3bef51fbd5bcfc600f088e394e78f725ef0328f8d3f1c54b55f7fa8ffae8a8400a63bd435ad95380c5699d","ssdeep":"6144:OSPX9LQwmaPsDnmnEPOTTMDvkktxk0/HVUxp5VQwKj/yVXX8Ud6ijvyQ:OSPX9LPMnmnEUIDvkkb/up5VQbj/DUdV","tlshash":"b57412e6ea210b45fcba6c1e8698cccada9d3fa955e3d1f30f4408249564fdef08d512","first_seen":"2026-06-14T20:28:34.022901Z","last_seen":"2026-09-13T03:05:55.490145Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1092,"timings":{"blocked":990,"dns":0,"connect":0,"send":0,"wait":28,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7hc0cxl4j41r00tnbmo.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.306Z","timestamp":1789268707306,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7hc0cxl4j41r00tnbmo.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 55124\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"e976653a67bf262382ee66c35da7efe6\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7788\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55124,"size_decoded":55557,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"e976653a67bf262382ee66c35da7efe6","sha1":"edd4c45625f081821e0d31a41b44b4e4a52e34ce","sha256":"e9a1032727f6d3f239fa146394ce640f88dcb93e2aac64760e5c88f6d90bae9a","sha512":"6432016386187695ac9b6736aeff6a0c53669304a27bf0b59fc0ecff177f630ce8629604ed5dc38fd639425ae361c58a9277812987c34b907e5e35fd231b4ff1","ssdeep":"1536:UL2d2JSDV95w9qAoGuBt6UX43dD/rAzo+CnzM6:dYitGuT6UI3dDE0+oM6","tlshash":"4e33f24e7bfcc1b03a7719b7a0922008745602ad8d4a4c9df990a722553bea9f58d37f","first_seen":"2025-12-11T02:11:47.082903Z","last_seen":"2026-09-13T03:05:55.491156Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1187,"timings":{"blocked":1156,"dns":0,"connect":0,"send":0,"wait":27,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/language.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.766Z","timestamp":1789268705766,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/language.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-702\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23238-37990\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1794,"size_decoded":1376,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"43ed5d53e8c2b4588708ffbcdba08d43","sha1":"655b7c51ccf89d53e033f5276ac0422c51981749","sha256":"6b0fd5f46691cb99d1ee948b01517c1eb490f3aa291435a7ec2b9d1676d7cac5","sha512":"2fd5bf5a6b061101d78b0f59a69aa7600f3d5d894b95b9f7d8e8d9da49c183df5878f78d3d466eaa6551a3479815db70295a3cb9d9024d2fefd66b082d136ae4","ssdeep":"","tlshash":"1131eff903fa49c872410300a7d5e58d5b3ef3daf2a40194b38a35a19f684af227e109","first_seen":"2025-08-30T23:50:55.948291Z","last_seen":"2026-09-13T03:05:55.492182Z","times_seen":113,"resource_available":false,"data":null}},"time_used":491,"timings":{"blocked":314,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9tcyns7uxhiv0dqn2f9.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.231Z","timestamp":1789268707231,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9tcyns7uxhiv0dqn2f9.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 96240\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:45 GMT\r\nETag: \"63117da8731604f5ceb3992c09c271b4\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7775\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96240,"size_decoded":96673,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"63117da8731604f5ceb3992c09c271b4","sha1":"565b26f24e80b60553b17eea1dc3842aa8ea3e25","sha256":"041bac4de9ad9cd0b4a6efe81b64a9799d662dd7864b4f1ef9fa47bcb69f7efb","sha512":"b8637134e581b138b75cf8ad2dbb89e628a70beccaf509a722efbc94cce6f8982ddd0bc7f379631dd89f7ee1d402828a2e2593ef264d929c4a27f262dfbc9ed7","ssdeep":"1536:exRPQ0c2CbBOPQ/QHg/IeAy+aQxIoQI7PjOQ4E7T2NuWgbUNez2dN3aJ8mRZz6KK:ezp1CU0QHgdqaeIJMPjOlqTgaou2f/EQ","tlshash":"f09302279a8b87b83af739a78f39b0351c6330950546f172f18649b05727ecebb954c4","first_seen":"2026-06-14T20:28:34.242185Z","last_seen":"2026-09-13T03:05:55.493156Z","times_seen":37,"resource_available":false,"data":null}},"time_used":980,"timings":{"blocked":945,"dns":0,"connect":0,"send":0,"wait":27,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un158jdecjzsp5s1m3xi0zgatlf.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.287Z","timestamp":1789268707287,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un158jdecjzsp5s1m3xi0zgatlf.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 36847\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:15 GMT\r\nETag: \"0b85904ff7b31d96a8246b076b5a187f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6968\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36847,"size_decoded":37280,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"0b85904ff7b31d96a8246b076b5a187f","sha1":"81a275f6547a82f66fc6e30fe1e0c90aa11a87b1","sha256":"d3690d9e8f71a3de07770bef466fd72be0f136a3eab3e346b4dc527f49f32a41","sha512":"1d4c00dd324bc68ac2c417dc2a6b8368bb4f333c8c3f881fea87221a4e203793c4e09cd3b3885551eea1b7d23a61f4af8683d5a4e78f52fa4626838cc2048c0f","ssdeep":"768:3fhc77Wvdb5DKQ9+xkEh9s31cdTudB6smPxIX5XPwfyZ:U6pKK+xHXs3cT0gfxYXZ","tlshash":"d5f2f191e35ec447f8e665bd0aff3735be0b6a91a55e0605f34ab4420e3660dfdc8412","first_seen":"2025-12-11T02:11:47.068124Z","last_seen":"2026-09-13T03:05:55.494154Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1127,"timings":{"blocked":1096,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/channel/g9kdwd056cidior6pjgx9zgqh2k2s628.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.172Z","timestamp":1789268707172,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/channel/g9kdwd056cidior6pjgx9zgqh2k2s628.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 361015\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Thu, 21 May 2026 23:45:54 GMT\r\nETag: \"6fd12322ecadfb897820045fbc6cb255\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04koU196_38874-6955\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":361015,"size_decoded":361449,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 2400x500, components 3","md5":"6fd12322ecadfb897820045fbc6cb255","sha1":"35cf70a389183581e6790bb1adccb6abec296b82","sha256":"feca4090d95b3c27463b5040afb7e105a7f8674262e4300b42c7a7889003a258","sha512":"f32c24259b07a5db289508e3598db98553fe09919805d98a6394891073d1f29ad256dd676fbdc9b9d25b63989b0c5ea6454e37c66991f4e5a2a62cf6e33adf18","ssdeep":"6144:eygvnX69U2BlAUKxjV4fOac2JG9FICqIP2Qy9TxrlejFIeazhTL7zz3Mk65npbDY:eBvX69UyUjV4Og4PO9rw2X3zf65p3Y","tlshash":"e97412bf57853815f0b0de3d613a9b4bf31a85012951eba4cbb70a64bdc235c9e4268f","first_seen":"2026-06-14T20:28:34.213196Z","last_seen":"2026-09-13T03:05:55.495408Z","times_seen":37,"resource_available":false,"data":null}},"time_used":949,"timings":{"blocked":-1,"dns":743,"connect":27,"send":0,"wait":30,"receive":115,"ssl":32},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un289ede79a8kekso9dz0iwom29.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.298Z","timestamp":1789268707298,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un289ede79a8kekso9dz0iwom29.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 59819\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"1e2e0e6a2d6c7d945860a82f1f9e01e6\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3236\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59819,"size_decoded":60252,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"1e2e0e6a2d6c7d945860a82f1f9e01e6","sha1":"f33b4bea062bd68a3e723da4a97dc2cf9252ca6b","sha256":"48b0a3a3ee67ad8d9ea99dc28e2a12b6dd7fa5682809f7f5326fce9b0f958739","sha512":"18e719eb8582ee3ced5bbade89acafdb3be15a8097fb6ad14beba3fb2659a487d507203b769054c0797cafbe6aafb870b38c75e5c7a0f30fd1af13f1df69890a","ssdeep":"768:NnunRr8kVYgM6SoglGzXimgTFYTAxyHgWp1+Kznyb1RzvT6yD+KDYwdalQBMeElo:4RvJiCTACtkKbI7vuE+KD1nBrElo","tlshash":"c34302091ff5e70337cbb6c99922580dd51b3387906de8e1258627afc4a5a7ceeb9c10","first_seen":"2025-12-11T02:11:47.128706Z","last_seen":"2026-09-13T03:05:55.496772Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1156,"timings":{"blocked":1125,"dns":0,"connect":0,"send":0,"wait":27,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00011.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.345Z","timestamp":1789268704345,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00011.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 38781\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-977d\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_46621-35449\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38781,"size_decoded":39426,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"8878b6f86a71ce18757fb0b50b975097","sha1":"afc5177f431b8049263926ecf20ae0fd6ecd40f8","sha256":"41bb1ead57e80df2c49f62a744c9c822a9cd39749686d072fc97cf9f90b0f1d1","sha512":"bafffe2f4570dfb13c566532fe483d8549496dbc22756c95f5500b2b24dcbd77fd5b38fd0711430f2ab585a1083363c5170094f52d24589876313487a3522b61","ssdeep":"768:FsEHwexAzPBjXgGaEoD/7gf95LfB3ZCbGlMpozz61uCYhb2GKSDx2Ki:mODxANRa9D8FPZ9lMkmo6GK+wKi","tlshash":"9b0301015d3eeb62d38aa03423326bdd9551c50e4d6f69a38242bb52d3cc57e60cdf7a","first_seen":"2025-03-14T20:40:58.471037Z","last_seen":"2026-09-13T03:05:55.497996Z","times_seen":119,"resource_available":false,"data":null}},"time_used":1309,"timings":{"blocked":1125,"dns":0,"connect":0,"send":0,"wait":178,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/service_icon2.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.730Z","timestamp":1789268705730,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/service_icon2.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/assets/style-BAEGjb_c.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 849\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-351\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23850-31928\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":849,"size_decoded":1495,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7bcc574769b0632777fe4b59fba33ec8","sha1":"cb24ff27b711f59cad03e0df94c82659ccf0b7f9","sha256":"f41486d6a9cfb6f9cd36fc6a55786aa0a7dac209eff3e17555d447b60458b8a8","sha512":"527591078dad51398274f7bf261ab92e6d29777b2cc432c5412ab5c603b615f95e667ea618d230cd20ab83f63c264ea83d8a4bf24e1f27bb3393b665fbff56d2","ssdeep":"","tlshash":"77016bfc526a89d9a0058705d7dab9882b2df297b3641469b30a20a56f2002b79ff54a","first_seen":"2025-08-30T23:50:55.07852Z","last_seen":"2026-09-13T03:05:55.499101Z","times_seen":109,"resource_available":false,"data":null}},"time_used":191,"timings":{"blocked":5,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1lc2ddvdnru9zspk7s0t1esbj.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.227Z","timestamp":1789268707227,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1lc2ddvdnru9zspk7s0t1esbj.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 91558\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:20 GMT\r\nETag: \"1606ad57d4da3e9b861f530d2aa70328\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30808\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":91558,"size_decoded":91991,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"1606ad57d4da3e9b861f530d2aa70328","sha1":"1d23b8518e134dcc18727e4a5730d6a8110fc259","sha256":"9517fbddbf7bc6ed0dd8a0e8ef4f4a5ce1f336094102dca13fc4d842c778fdfd","sha512":"a46367b82fd8385288c14bf7a2822a279ab06019d451bc3ab7a6538232d09d4aaad49bf0cd005f67a5a2471a72d7ee6d669a019b65babe8ed1b75d0f5b52a7a4","ssdeep":"1536:83Ole3+0jhQcHmW6vox5/rKZ6dExaIXmzhgWzxpubR2nT9NxycHPKyaXNLA:sOlPUhnHmzI5/rKZ6casgNuF2T9NJCLA","tlshash":"c893126c4831299f89b3abdeefcd9fa3833357416761c284be6d5d08581d2884d1a93f","first_seen":"2026-06-14T20:28:34.208677Z","last_seen":"2026-09-13T03:05:55.49994Z","times_seen":37,"resource_available":false,"data":null}},"time_used":970,"timings":{"blocked":935,"dns":0,"connect":0,"send":0,"wait":27,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/language/static/list","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.953Z","timestamp":1789268706953,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /language/static/list HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 34\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":34,"data":"{\"languageType\":\"CMN\",\"isPC\":true}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: f35c26f4bdb10187295\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_28018-9778\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":174172,"size_decoded":23862,"mime_type":"application/json; charset=UTF-8","magic":"Unicode text, UTF-8 text, with very long lines (58136), with no line terminators","md5":"ee649d77e731ea8e0c72b5974e4c0340","sha1":"5962e3400ebc58dc7e7d1abc9e024679e915acd8","sha256":"9d232bdf0455e2adcfe76184efe535c47a4b4a135b739369134aab7b5a216d6f","sha512":"564152cddc7a810d6bbe62b9d065e8dd4579d81ae1cc0614072fb9760a5655fb33524fbd30677d368111eca941fb899971f9f64e4060f6d398ff61c7f12ef50f","ssdeep":"1536:pVyTZHPeuFxsFsX4Fmyr/GTr53Y3j/lyShdc+DTMkT/j0hlFPHwufJJM5/f9zZSF:pVyTZHPeuOmVT6zdt7T+PmLRO","tlshash":"730430402f089478f2f87da216df4f5f32e2f828b467ad7982d03ada568b410d52577b","first_seen":"2026-09-13T03:05:55.500759Z","last_seen":"2026-09-13T03:05:55.500759Z","times_seen":1,"resource_available":false,"data":null}},"time_used":461,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":460,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7hknp3xsow106z0ilp.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.194Z","timestamp":1789268707194,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7hknp3xsow106z0ilp.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 100410\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:12:51 GMT\r\nETag: \"e0fcc43c0c3c2eb0d60a5017482cc1df\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2128\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":100410,"size_decoded":100843,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"e0fcc43c0c3c2eb0d60a5017482cc1df","sha1":"e07d0af9b8df310e0f2ef736b7e361021b4261de","sha256":"58f693b2c51d6ce225c0892734f35a948fbf9a765334831fcf9784054cf2b90b","sha512":"a556247095ebcedb678b3f8554d07c2c46111b457fa19681bcb3b21374d819f680fea28d9fa3abb20ff29c88aabe9f04122737037e3876f6b50d5e0ff39c6246","ssdeep":"3072:csXQiMWRDg583pZrJwXrhRrtl/4yIiEXBeNv/Wqw:csXQiMWW58ZwXrhRBSyuXG/Wqw","tlshash":"57a30201fbeef53992feea2e3772106ecc45076d7815ba96ef5833386c9120d409a497","first_seen":"2026-06-14T20:28:34.265919Z","last_seen":"2026-09-13T03:05:55.503217Z","times_seen":37,"resource_available":false,"data":null}},"time_used":939,"timings":{"blocked":904,"dns":0,"connect":0,"send":0,"wait":27,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7gw08jp9qlt0t9655t.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.182Z","timestamp":1789268707182,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7gw08jp9qlt0t9655t.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 114362\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:11:58 GMT\r\nETag: \"c3d66982da1578cba33bb20dcfb7f900\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3225\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":114362,"size_decoded":114796,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"c3d66982da1578cba33bb20dcfb7f900","sha1":"a36c403f8a056ba5cf07d0cd85ad77ab4d0d69b5","sha256":"9db7b673c684fb77341b4a83b41649cfc5996b90ec0ac5db8aca7b269ec91283","sha512":"a1f7d3c4f43b360e8d929d20ee85002c3f8e6aae6b6593990c2f2ba2ec63f76c31e6c115babf402af7948575f848206519902eabd05acfd483b6fcf20a686f1e","ssdeep":"3072:TvZTX8FrRWGKxBJezQGlL/AF/n71SZlRFo9ukKRiXs:N78FreBEzQ+TAF7kXRO9uknXs","tlshash":"ccb312ac2d9893891630b9d3539e57cc7e70e148bccab2d8dd9f52f2b00f63851786a1","first_seen":"2026-06-14T20:28:34.065436Z","last_seen":"2026-09-13T03:05:55.50402Z","times_seen":37,"resource_available":false,"data":null}},"time_used":934,"timings":{"blocked":876,"dns":0,"connect":0,"send":0,"wait":28,"receive":30,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.346Z","timestamp":1789268707346,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 153\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":153,"data":"{\"type\":1,\"sportId\":1,\"leagueIds\":[17663],\"current\":1,\"orderBy\":1,\"isPC\":true,\"oddsType\":2,\"beginTime\":null,\"endTime\":null,\"languageType\":\"CMN\",\"size\":1}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nContent-Length: 97\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: 45f26f4bdb170bcb1\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e4_PS-AMS-04DYH56_32057-10417\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92,"size_decoded":595,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"e4662bc44588377e782fbce985062799","sha1":"2987db379501adc2e2bca61f781019807920c97e","sha256":"358d7afa85146a073a8eac196998feb68f56d889bb126b05f38eca84fca2db9c","sha512":"3a819045f743ff4fae408526cf42ee34e7681f99eb7603292ad3985da9667553775c2ff84ea69893380b9071f4c4e0f8c377386587965d1ee3c4f343591da958","ssdeep":"","tlshash":"26b01209440c0272f24191c5102b251287bb210a1d100a0089ec834c8d0e0092182006","first_seen":"2026-06-01T18:09:18.929363Z","last_seen":"2026-09-13T03:05:55.48538Z","times_seen":32,"resource_available":false,"data":null}},"time_used":242,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":242,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzlu2rk54dlf80djpr1p.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.203Z","timestamp":1789268707203,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzlu2rk54dlf80djpr1p.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 88721\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:27 GMT\r\nETag: \"b9a3130d85a77987819661cde91cfdb0\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6958\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88721,"size_decoded":89153,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"b9a3130d85a77987819661cde91cfdb0","sha1":"ccc61e949a167f3c4e3327f5fe948fb305fb31c1","sha256":"902219aab4044246173cfc60fe244a9fe08f67947538fa611d177ea1b1e373e5","sha512":"d5477995ff8fc23d74818d013b29ffb4a5ec353d9f88209dbc7d1a1b72685542fe53997b42820b728487b9b99b2266512c851713b41aaf11a20c75afde8e2137","ssdeep":"1536:TssBrcUKA8Bc7lxXjy0PaGSbX1suEo1cPDWrQxCl6wTub7TyYUHIBHVdJQFmdE:Q4oPBcJxXjyrGSbk7WcxPb7GYUHuHzJK","tlshash":"b183128652d74f2beed10d1eb065d13d9aaaff87c603c2758ebd9c124d75500b30c8aa","first_seen":"2025-12-11T02:11:47.236751Z","last_seen":"2026-09-13T03:05:55.50483Z","times_seen":41,"resource_available":false,"data":null}},"time_used":944,"timings":{"blocked":911,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlix6p8ts07o0z3scxw.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.326Z","timestamp":1789268707326,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlix6p8ts07o0z3scxw.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 90432\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"4c77849b00f9e5f4819354ab30c1678e\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2145\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":90432,"size_decoded":90864,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"4c77849b00f9e5f4819354ab30c1678e","sha1":"d58e3d8687f8718ea9641724134eede6ac95ae62","sha256":"437efcf1d4f80d3bee3c9a17ac76aef937d1eb5ccfd0c8a29de0fa86f289c4ee","sha512":"8b5087f3756376b4872b19b8a80af24867988fb28eef43ab74007cf62e27f5b730fd6207c0c19206c6d88c5f34726ca291ac6581bfbb9992d3677535b9911b2f","ssdeep":"1536:QTJhf3H6Mn+VzsH/aXMrCtecFaLROmPgrS5i8n7NhU4gZjIrf5HIEB:kJ13H6kyXSCtecUPo2pn7IYB","tlshash":"3b9312cb78461e60d6b8f3baa796bf7388c09fc85714899b1a7d3ec425b6c51033518c","first_seen":"2025-12-11T02:11:47.141371Z","last_seen":"2026-09-13T03:05:55.505845Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1261,"timings":{"blocked":1227,"dns":0,"connect":0,"send":0,"wait":27,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqekdcpyqnaekun3ke8.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.827Z","timestamp":1789268708827,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqekdcpyqnaekun3ke8.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 7017\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"304295078f1240b6829a4f88b92e32be\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30826\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7017,"size_decoded":7449,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"304295078f1240b6829a4f88b92e32be","sha1":"03198d93370e77417ffddc9691f9c0467a423963","sha256":"3d4d5f26d6a1d9306a712bced7c6046124130587061b498892ef147ec5e171a5","sha512":"d049c42e8b2e17fb4a3b0beef21cbfad179d27066e0ab2029490d8a4394f1320736a4deb124cdc701399e96dd76a7ce93cee6f23007a6c4d0d22cf15870c6a37","ssdeep":"192:qEZoj3wZSrQ+/t9D921738vsWwEUyTrEin5dBI4:EgZ549sM5FTginFH","tlshash":"d2e18e22d94887e256e8473ec7b1d83585e10e8b92560b070ab03ab75f7ba55297bc1c","first_seen":"2026-06-14T20:28:34.152529Z","last_seen":"2026-09-13T03:05:55.506903Z","times_seen":37,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/accessWithoutAuth?gameId=1\u0026lang=zh-CN\u0026currency=CNY\u0026appType=4","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.829Z","timestamp":1789268705829,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/accessWithoutAuth?gameId=1\u0026lang=zh-CN\u0026currency=CNY\u0026appType=4 HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: c84fc8a468c2d4186ba7b35cb5256a6b\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04koU196:33 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50987-6409\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":928,"timings":{"blocked":748,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkvrkvrbx15006ppy93.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.264Z","timestamp":1789268707264,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkvrkvrbx15006ppy93.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 39867\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"5c577757b16ed1aab676aad04b78c0cc\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6966\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39867,"size_decoded":40300,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"5c577757b16ed1aab676aad04b78c0cc","sha1":"d87f812d301a2364631d5b2b24c87c1b648fed6a","sha256":"6024ca97d95ba373832441c468e1ce9460bccac4ac62b8b244f26bd463d0d1cb","sha512":"3e23011a2fb4ba09e9a873a544104c1ef291d8c727b02385e3488f2924d18c527cce4df0d4862fe829c92736564c9a82dffe01c869a04a8d67b3d64fb12b3edd","ssdeep":"768:osDhi9zo+GPFpspAsRb7UM4kn7PgwNTs/HjLErFSmEk4iKPmVd7/o6:osDhFjbspAsRcM4kDtNTsbeFSmyPEd79","tlshash":"e703e120baa6f707d755fb7ae38fc65be2850b8c29951d14d4d1020fb0a3558ca2796c","first_seen":"2025-12-11T02:11:47.119991Z","last_seen":"2026-09-13T03:05:55.507806Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1077,"timings":{"blocked":1046,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameSubList?categoryId=4\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.360Z","timestamp":1789268707360,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/gameSubList?categoryId=4\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 470d342a69c2d418f4a7b35cf5dc3efb\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3245\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1565,"timings":{"blocked":1385,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/sys/appVersion?platform=1","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.810Z","timestamp":1789268705810,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/sys/appVersion?platform=1 HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: dce8c48c68c2d41850c63c2986aa2190\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_56153-3214\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":534,"timings":{"blocked":354,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/menu_promotions.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.776Z","timestamp":1789268705776,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/menu_promotions.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-502\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23850-31932\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1282,"size_decoded":1196,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0c2cf08065cc9b351ebfac3acbed33a8","sha1":"0eb069b3d90c35518b6784b000d3818906cd271f","sha256":"05bf53887ea13293608b583af51dc76358b4fe5f40e0439baf70d00e33a977c2","sha512":"e22e82fc80dbef655b57d1f430dcef3727c9adbed44b08d558573fcf47e6f76d70e683efffd3da99f3c8d4af61739e847fd069f07bdd9b475f40308a78de61ca","ssdeep":"","tlshash":"fa2147f136f9079dc509c78de7e9b58c563cf2eb622d01a8b758215a5e3009f36ae109","first_seen":"2025-08-30T23:50:55.366448Z","last_seen":"2026-09-13T03:05:55.508689Z","times_seen":111,"resource_available":false,"data":null}},"time_used":700,"timings":{"blocked":514,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkwhmspz1p590osybou.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.268Z","timestamp":1789268707268,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkwhmspz1p590osybou.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 48306\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"ced6e047aed9c8b5b7df4d74fb4b0a71\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30815\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48306,"size_decoded":48740,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"ced6e047aed9c8b5b7df4d74fb4b0a71","sha1":"861fbc0972e1d31e896eadd77a32dae16cdce7d0","sha256":"dd74ed3accb6598bb77de09d2e8bfdd5e35a722818101b1595a73f954d949ea6","sha512":"c11e96a3ddf6b9e62f9899f3090894f3498a63a71daec39b7607b402893bd06268dff703574453fa664d16aae862bb4eeb1119899e4463dbfabb650ca52bb633","ssdeep":"768:JbL1MlVC/gynnksjldC9gAl+tM6QqINe+eQ8PFZQQR+DTPxhdhcY/GGu:nMjgxksPC+8nq2e/Cq+DjPL/A","tlshash":"3923f1352327e353cf12a0748904a65e46a4dcede8739f1d3c33ab4addcaab402f4965","first_seen":"2025-12-11T02:11:47.206768Z","last_seen":"2026-09-13T03:05:55.509651Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1084,"timings":{"blocked":1052,"dns":0,"connect":0,"send":0,"wait":27,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd026cfdibgrttoxufhloblgczby.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.836Z","timestamp":1789268708836,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd026cfdibgrttoxufhloblgczby.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 51780\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Wed, 06 May 2026 08:51:24 GMT\r\nETag: \"b3a833884686eb73a4f38e176a1d8a6b\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33037\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51780,"size_decoded":52213,"mime_type":"image/png","magic":"PNG image data, 284 x 284, 8-bit/color RGBA, non-interlaced","md5":"b3a833884686eb73a4f38e176a1d8a6b","sha1":"cb8458121bd45a81d67c533a1e18b49d21feabcb","sha256":"04e2e61e97dfcabe3486a8b235c387cbabea861bae7b532686f322a562a78488","sha512":"99b5620dd5e3a2a0d6b308570fb14cfb2f538f3accec47f98a85dac48501a8b1a16bf2c76d65c337ed05ca24361c74e10a7fbe1c1fe27daa22a6f74265559c9a","ssdeep":"1536:ZYkQyXcO0h5brxmP3mYPgyqonRAvFhEFjAQ9KpeC:osct1XanRAvFL6C","tlshash":"2c33f1051ee960c8c664c97cefcd9521ae06470a2adcaf3ad73bf684076d1827c626f1","first_seen":"2026-06-14T20:28:34.127157Z","last_seen":"2026-09-13T03:05:55.511562Z","times_seen":37,"resource_available":false,"data":null}},"time_used":31,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01kmad66yxif5juljp97bneu8f.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.937Z","timestamp":1789268708937,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01kmad66yxif5juljp97bneu8f.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 2419\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:07 GMT\r\nETag: \"adcad16787247c931651cc3b003fbee7\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04koU196_38874-6983\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2419,"size_decoded":2850,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"adcad16787247c931651cc3b003fbee7","sha1":"913d15db285302d864455cf52ab09008233a996a","sha256":"3fe9675a9fa6045b5a07ef603baaf1143ce523428b177d9ff87cf4ea95a8adb0","sha512":"827bfc97476f0935236aec29c90723aa7174795ae522e6845cdcd2355a97384c3b2b777136813ae9dc65fb3ca41a4ab8af7dce497c3b6975edbebc8be4386cce","ssdeep":"","tlshash":"b5416d7ef2b0bf71650e503ed8e44533f8937433a55e0f8120276a2fbc00780454b661","first_seen":"2026-06-02T06:09:34.296631Z","last_seen":"2026-09-13T03:05:55.51228Z","times_seen":45,"resource_available":false,"data":null}},"time_used":96,"timings":{"blocked":68,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00010.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.344Z","timestamp":1789268704344,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00010.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 39173\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-9905\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04koU196_50640-6024\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39173,"size_decoded":39817,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"9805223ff8f710fd5f09201bdd9ad439","sha1":"55e5035324a1a4f6975eba058e956b1a9e2d298f","sha256":"f4674042bd921058c8abd0ae9e2629cdd9d26ef36ab5c3669f0c4916955f4926","sha512":"19016e1f1cb21cb4247d839719abd0ad8367a09e834003228cc338d3c3bc7a9fcbb840841f54329fd972786a04058555ff69ca7ece0c32b78cedff2209050009","ssdeep":"768:tddSTxocAa3jCXGOkbCsWFmTqhmKxvhfS+OH4y0usdge8te6gEMx7htz:tddSFq7XSCN4KTqr4y0uKMenEO1x","tlshash":"8903f1f972930681fa5ad72fd28874e5636f6543ce671204488b3f4aa829a277c0c734","first_seen":"2025-03-14T20:40:58.517164Z","last_seen":"2026-09-13T03:05:55.512934Z","times_seen":120,"resource_available":false,"data":null}},"time_used":1309,"timings":{"blocked":1124,"dns":0,"connect":0,"send":0,"wait":179,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index.vue_vue_type_style_index_0_lang-KRK6zDtf.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.409Z","timestamp":1789268704409,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index.vue_vue_type_style_index_0_lang-KRK6zDtf.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-694\"\r\nExpires: Sun, 13 Sep 2026 15:05:05 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_24105-30055\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1684,"size_decoded":1504,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1683)","md5":"fcd693ccd2bb4288c64bc2cf91a6b06c","sha1":"3d6d7c464db08108f533b8d762ec9f822a882b9e","sha256":"7f523c17f64c44cdf39b995d687e2a37118a391334efb45c16d567e62d1be502","sha512":"62e8701741fe133267f72371d1a19947b832c0798801cbdb72c23a1492b222d7c1425e2b74d306a42084ecbdeb1a40720e5549c242c0b9f37a3f4ea568cdade2","ssdeep":"","tlshash":"e83186acb51db0f8e273146448301437a2772e2cb025fa0102ec0d5a964be2c87dcb25","first_seen":"2026-09-11T22:02:29.478732Z","last_seen":"2026-09-13T03:05:55.513535Z","times_seen":4,"resource_available":true,"data":null}},"time_used":778,"timings":{"blocked":598,"dns":0,"connect":0,"send":0,"wait":179,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/channel/g9kdwd010qfdhm09in20888t002oqkwc.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.095Z","timestamp":1789268707095,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/channel/g9kdwd010qfdhm09in20888t002oqkwc.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 139900\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 06 Apr 2026 10:49:14 GMT\r\nETag: \"47b8e9143b1dcfdf3c23df7d0253213f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04uki195_56153-3223\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":139900,"size_decoded":140334,"mime_type":"image/png","magic":"PNG image data, 1420 x 499, 8-bit colormap, non-interlaced","md5":"47b8e9143b1dcfdf3c23df7d0253213f","sha1":"2eecad73bf1c0eed33decc57e8ccda7689fe3d37","sha256":"aa16d18025a03c3a2f73f5a51e33cb45d5eb3d426f333ad7a8a2d4356dd9956b","sha512":"a31614d333f79754fe583aa8fc00dc1e113e4ff44ec44fc0c9ced3179c75013348d221890a13f3f68a9463802ee5f9cfd03154141a33eb43e018f59a68a856ff","ssdeep":"3072:ChAK+YWKVp0BbrbMwsLdVs22PaobE+gt1GWAynNhd2z0qBhSIU:ChkYJcxsZVEa5TCzyMgqTSd","tlshash":"d0d312664a709d6e958409bd499a6123f3703d9d58bff21139b9b8cf02b4e4f42fb342","first_seen":"2026-06-14T20:28:34.31284Z","last_seen":"2026-09-13T03:05:55.514265Z","times_seen":37,"resource_available":false,"data":null}},"time_used":965,"timings":{"blocked":-1,"dns":820,"connect":27,"send":0,"wait":28,"receive":56,"ssl":31},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9t92w5d0b9hy0cb55e3.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.239Z","timestamp":1789268707239,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9t92w5d0b9hy0cb55e3.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 93348\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:44 GMT\r\nETag: \"a750f6f588fcff0a2f7644f0404e4d65\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7776\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93348,"size_decoded":93781,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"a750f6f588fcff0a2f7644f0404e4d65","sha1":"1bd571910d838b5d300e374899c40fce3e651489","sha256":"c89224da020c465ec2a031787000a84d00dadced4b924492fe3782c65406face","sha512":"8e4613bafd7d6d6a49f51309cb8f723ba2495c5229c3f3a6fae1493b5512b84030b718b78d05a8d1a61a114872d66253c337735b023406844c2b7b4971a2b620","ssdeep":"1536:w2eUYrRbLH9f3wHaQu21F6Z+AfC8+rsNelHkzYCO+dgr63CkN7WM2KfWwUfs:wqYL3m6y8sPkz9OKg3RYWwU0","tlshash":"63930253e6888878e95f578c608525a8445fad4e8fc767cbe036380e5da2fbb291142f","first_seen":"2026-06-14T20:28:34.291577Z","last_seen":"2026-09-13T03:05:55.515354Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1001,"timings":{"blocked":962,"dns":0,"connect":0,"send":0,"wait":31,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlj2ktcnvy7r0hly5g5.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.335Z","timestamp":1789268707335,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlj2ktcnvy7r0hly5g5.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 99514\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"91887b906889335a439839ebb36cb1e6\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30823\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":99514,"size_decoded":99947,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"91887b906889335a439839ebb36cb1e6","sha1":"c3b3eb07db1c1727c237819edb2dc97e99c7b651","sha256":"5d5276bdf612fe820c05cb93c63d250938eac94e49ae886848145832897f9eb5","sha512":"270313bd71bba5d561a65396e58a840931b66fa5ce653701bbd1d077f85da5113c3faa44da11429fe23444137c030a582b8aff397f8df8ece8a63af634a63f65","ssdeep":"3072:VZpqBHZqOE6bieYS6eFoBo/9vcXvqhOXK2E:VyBHovTzeRVc/Y2E","tlshash":"f1a302d6c3f29c68338ab6cbf5e2ebc849a2569584cc42409c0672d0fed533954faa95","first_seen":"2026-09-06T17:58:09.826626Z","last_seen":"2026-09-13T03:05:55.516149Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1254,"timings":{"blocked":1217,"dns":0,"connect":0,"send":0,"wait":27,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1lc2ddvdmfcylip87g0fmwwp0.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.223Z","timestamp":1789268707223,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1lc2ddvdmfcylip87g0fmwwp0.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 82106\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:20 GMT\r\nETag: \"3fce2b7604fa00fcfebfa9c8c70825c6\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33020\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":82106,"size_decoded":82539,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"3fce2b7604fa00fcfebfa9c8c70825c6","sha1":"fea382a189cedcd971a6f2674ea1df390d5e6095","sha256":"2b041041c71e04bd0cea9ef417e04093a2e873af321b9ca15579e442291fbbb0","sha512":"0f58d4f50afb6d2b0b74587fdd396f420592bf9594e83e0a54906499554ca5a92358673e5bd2d361b41c402b28b5fac060041a9f24e3161cfcb5a429101b755d","ssdeep":"1536:dMZFLmycyGLN7umZh8UEDWP6rUu0rRIaLqQeFBZG+pH:dXyoUmkWPYpIPqjVpH","tlshash":"5883128628dd979ea222230ffcd3745cc8ebe5464c2706ea3a4cf61e5c9725d1247e4b","first_seen":"2026-06-14T20:28:34.166203Z","last_seen":"2026-09-13T03:05:55.516898Z","times_seen":37,"resource_available":false,"data":null}},"time_used":962,"timings":{"blocked":929,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdee1s30v7gxd3iuvw3tn1.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.339Z","timestamp":1789268707339,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdee1s30v7gxd3iuvw3tn1.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 81395\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:54 GMT\r\nETag: \"e9c486053c48cfabbf9d9ac619994944\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7792\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":81395,"size_decoded":81828,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"e9c486053c48cfabbf9d9ac619994944","sha1":"00679f101094e01a4ad5c8fdab8a681c47895e4e","sha256":"d0b2b59be31d6979b00cc83a945517a4340b3ddcf87adf46800deebb907c9998","sha512":"b107e083aa4bdc1ff980d72e54038a75197421c81d6f915337b8a780fc1f817ec456c498fd8b697b73b22a2729029e64f82fccff275b00cb4165a8541b5d37d3","ssdeep":"1536:4K1glQ6i+ozF1R1D0JhfmE3pv7ISk/i8vrZ+58D7H7gvoFJ5IvBTQjDQ:4sg8HJHOnfFz4pE5mH0vrCc","tlshash":"0a8312ca645df57f62015e1456cfcdcbd8b7f7471a0047a8882e848f3e8c9c0b6949da","first_seen":"2026-09-06T17:58:09.657406Z","last_seen":"2026-09-13T03:05:55.517656Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1274,"timings":{"blocked":1235,"dns":0,"connect":0,"send":0,"wait":28,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.347Z","timestamp":1789268707347,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 153\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":153,"data":"{\"type\":3,\"sportId\":1,\"leagueIds\":[17663],\"current\":1,\"orderBy\":1,\"isPC\":true,\"oddsType\":2,\"beginTime\":null,\"endTime\":null,\"languageType\":\"CMN\",\"size\":1}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nContent-Length: 97\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: 5d726f4bdb174a7bc\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e4_PS-AMS-04DYH56_28018-9787\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92,"size_decoded":594,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"e4662bc44588377e782fbce985062799","sha1":"2987db379501adc2e2bca61f781019807920c97e","sha256":"358d7afa85146a073a8eac196998feb68f56d889bb126b05f38eca84fca2db9c","sha512":"3a819045f743ff4fae408526cf42ee34e7681f99eb7603292ad3985da9667553775c2ff84ea69893380b9071f4c4e0f8c377386587965d1ee3c4f343591da958","ssdeep":"","tlshash":"26b01209440c0272f24191c5102b251287bb210a1d100a0089ec834c8d0e0092182006","first_seen":"2026-06-01T18:09:18.929363Z","last_seen":"2026-09-13T03:05:55.48538Z","times_seen":32,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":239,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd0ria0dimoghe71yzu6ae4abuj2.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.341Z","timestamp":1789268707341,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd0ria0dimoghe71yzu6ae4abuj2.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 37159\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Tue, 19 May 2026 13:12:04 GMT\r\nETag: \"6885c5cbeaa50c7a0dc0964fc73c48b8\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30824\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37159,"size_decoded":37593,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"6885c5cbeaa50c7a0dc0964fc73c48b8","sha1":"fda69e0afca11917df6b8e90ea898015317fa62c","sha256":"d39cc4206e436235da1ccf404106de0c16b3e5763625e76003261fb1e079eb7d","sha512":"f8e4b6eb2fbb22a708810e7f44ec5b7b3c99e73d4cbd1ae928165366b7732aa027e1cfa920f01fe1c1b975561fe2dd9cce23f5717235fda1d9ec32f235ae9272","ssdeep":"768:zhnbeUnoSwHU//e12b3g+xcuxbGo1LJOeOwF4tikho/ABL45geq0n:9oim1yaudVlJOQkho/sc5gejn","tlshash":"bdf2f125dc361081d2c33ebdd862fb542ff403885e8a3fab1a66d1ca35dcb945d02c65","first_seen":"2026-06-14T20:28:34.058898Z","last_seen":"2026-09-13T03:05:55.519743Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1283,"timings":{"blocked":1252,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqii1wqyqcmsq6i2o9z.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.853Z","timestamp":1789268708853,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqii1wqyqcmsq6i2o9z.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 3873\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"9a49f57bd3c781d4202d2d9d01ef453c\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04VRO197_22295-30828\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3873,"size_decoded":4305,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"9a49f57bd3c781d4202d2d9d01ef453c","sha1":"de1ead8d5ec89c6defb0a6a86fa27170eff3a369","sha256":"d8e9250778777578e4af7ec65f633b7733ce3616c5128ac3f57efa02fa9f85c8","sha512":"7539542e6b4d7a7799c0e8a17f0668afaba09e071019b31c59e19cf96d6850db9809f6db72beabbcf9f5fe3e4384af6d9d18bae5be6c9c9d43f248b7d9f230ed","ssdeep":"","tlshash":"93816df6a4372a43d245e4b59a198b87d590ce28ce2b4f86bd70a06447fe7803dfe501","first_seen":"2026-06-14T20:28:34.14064Z","last_seen":"2026-09-13T03:05:55.535079Z","times_seen":37,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":144,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00001.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.333Z","timestamp":1789268704333,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00001.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 28395\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-6eeb\"\r\nExpires: Tue, 13 Oct 2026 03:05:04 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04koU196_50640-6015\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28395,"size_decoded":29039,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"33ee372aba1afc7dc5255ee477efee32","sha1":"4ea7b623486942d6fb58b132aafee05bba956dfe","sha256":"1e263fd068ff95ec4d6848881ad4444255129927f62dc633659957ec1e3520d6","sha512":"e74bbebda4c58756c497f253e8ae79692832f2da66320867dfa5a11b48c3304e39f974c10752ae20a5ceddb4e371389dfcde997df902e5110be0af0ee2649757","ssdeep":"768:FoyE4wVJhjLxOW/6c92vf3C0CN8zzKSYSdgk7Sp:FoyyRjLofS0CN8zzKS7dgzp","tlshash":"8ad2d0536353bc36e2ee89f305ded69b2f0359b4823bd762c215e7309c17e6a485a182","first_seen":"2025-03-14T20:40:58.545965Z","last_seen":"2026-09-13T03:05:55.537453Z","times_seen":127,"resource_available":false,"data":null}},"time_used":805,"timings":{"blocked":-1,"dns":0,"connect":26,"send":0,"wait":779,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/visitor/homePageMenu?lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.805Z","timestamp":1789268705805,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/visitor/homePageMenu?lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 74f9998368c2d41842c63c290f43c546\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04koU196:33 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50987-6405\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":383,"timings":{"blocked":201,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00008.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.342Z","timestamp":1789268704342,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00008.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 39243\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-994b\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23850-31925\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39243,"size_decoded":39888,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"9da34197eabcc1e752c1f126e949995b","sha1":"bad412b5c7893c10695cf747145e809bc9034e6b","sha256":"2b774e104227aacc14b900b1b05687004c3dbc107840393f1f80821f4da24277","sha512":"88644998a64d1bbf02b10c7f98834395b8f01590e19a006d73591a88d68be586efc107d8d1dd848a0f773336a8d15de23b7014576c9d7dd369bfbb3ffebdeb9a","ssdeep":"768:mxaFUh5SpXMabKNVA41x+UIFqWs1+VDepP0HvMS+i1FntK4U/+xysv14:TFUzStMabKNu41BcZsODAsPoi1JtK4M1","tlshash":"25030298b59ef415d2ff4bf989c8be0a53cea3fe31155571009cbe46125c9a9dc8c06c","first_seen":"2025-03-14T20:40:58.532584Z","last_seen":"2026-09-13T03:05:55.539564Z","times_seen":122,"resource_available":false,"data":null}},"time_used":1171,"timings":{"blocked":983,"dns":0,"connect":0,"send":0,"wait":187,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00032.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.388Z","timestamp":1789268704388,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00032.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 29999\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-752f\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_44919-40727\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29999,"size_decoded":30644,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"837d122d6553c122e29680feb39bb3c8","sha1":"ccd611c37b89ee7fc1735dd5350f52de3e9d2a08","sha256":"864aff45e38a5e7e6ebee51a77f463d14dcf88321079937ea95b88acddf7ba84","sha512":"5f8a26938ff4902856e547774278f9683015eca9778f1a069dad0390141405ff9c0526dfd58d7e7ee8c615716888208b6c28ee273964d1707eedba42001adfe9","ssdeep":"768:J9xWq1+gx+JQ29r/eqBT8bOAn7XpVUDYs:lzsv9yqBTSOA7XPUh","tlshash":"e1d2f154eabfb2f8dcac193597817799301ebb04bdaab851d419093ade4350c044ff36","first_seen":"2025-03-14T20:40:58.570982Z","last_seen":"2026-09-13T03:05:55.541566Z","times_seen":113,"resource_available":false,"data":null}},"time_used":2585,"timings":{"blocked":2402,"dns":0,"connect":0,"send":0,"wait":179,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/recentOrderList?lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.270Z","timestamp":1789268707270,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"GET /uapi/game/recentOrderList?lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268707\r\nx-cq-sign: 2afed867b026e81325fbac3c4eb7ba779a5d3e8ce6e67703e87e93a07d6a01c680ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nCache-Control: public, max-age=5, s-maxage=5, stale-while-revalidate=5\r\nCdn-Cache-Control: public, s-maxage=5, stale-while-revalidate=5\r\nTrace-Id: 607dd21d69c2d418fbc63c293789dd52\r\nX-Cache-Key: /uapi/game/recentOrderList:c66c341db95b0caea584cd66beed47c66e4d4e48\r\nX-Backend-Time: -\r\nX-Cache-Status: MISS\r\nx-via: 1.1 PS-CDG-04VRO197:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_25562-30864\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10516,"size_decoded":11454,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (10234), with no line terminators","md5":"95a4caeabd589bcc932580f1e7d96a3a","sha1":"23295bbafa671f3e4f575eb8fbeac62d708673f6","sha256":"de2206bff8652de4aed397235ecf7194b9400935eefa310aa797b0d0898fd7aa","sha512":"b4dc4216f6b9b5fee4825b32c0a03fca06a81b7d3ed84a01d4cf274c0c2f606c6f315a6d4863a96eaf3a641d729b250f67b5f364bd2370e85f4acf5114f5df4e","ssdeep":"192:64hjlJGjUHb2j22Djpbqj76Bx6jSQUj4pKjSGMjxA7jDDZjwNsjGX7juq7jui9jZ:j54YCSUFW6z6mpcsOHVMXNU+iLScSOrJ","tlshash":"18227b97359c1c6dae346bc188c7206c61bb7157f8da6dc2c9cdac1d8534aa0f912e36","first_seen":"2026-09-13T03:05:55.543276Z","last_seen":"2026-09-13T03:05:55.543276Z","times_seen":1,"resource_available":false,"data":null}},"time_used":207,"timings":{"blocked":14,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameSubList?categoryId=2\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.356Z","timestamp":1789268707356,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/gameSubList?categoryId=2\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 8eea071369c2d418d7a7b35c74beeb8e\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04koU196:33 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_50987-6421\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1177,"timings":{"blocked":996,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/right_hotLibrary.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.788Z","timestamp":1789268705788,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/right_hotLibrary.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 22357\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-5755\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_24105-30074\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22357,"size_decoded":23002,"mime_type":"image/png","magic":"PNG image data, 120 x 179, 8-bit/color RGBA, non-interlaced","md5":"de654ae5da151d2e449396600fb5ba86","sha1":"9a21bf08e93dfaf1117bef5eba2169cf0b4b6b3c","sha256":"ad6cfe4dd2af9c4f433c3c636063737ce7278298e552fcb8c6a42ef314eaf2f2","sha512":"6201a3ecacb962c6853a586d24ddba0bcae818b782821ef1a7c89f875d06ec731124f6ffc09439c0594c64d2ecc110aa7c9faafaeb5247d8066b79418eaf0e42","ssdeep":"384:irLN2yL1Se4mjtN3FmK1SnU3tLVOFja75ewNGwMxTzzYWV+j:uNjL1Sef0KcU9AJa75CwMp/Y+O","tlshash":"c8a2e10eba773e5d44cd20f90ad70adccb182e62713ccb7fa66f54dec0854aa1528971","first_seen":"2026-06-11T02:30:28.074369Z","last_seen":"2026-09-13T03:05:55.547393Z","times_seen":70,"resource_available":false,"data":null}},"time_used":1571,"timings":{"blocked":1390,"dns":0,"connect":0,"send":0,"wait":178,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/mapValue?gameId=1\u0026key=language\u0026value=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.421Z","timestamp":1789268704421,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/mapValue?gameId=1\u0026key=language\u0026value=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 6a282b5a68c2d41801c63c2998244d66\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_29158-31948\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1082,"timings":{"blocked":902,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd0b72xdj4b72ewg5xxgza2zvcdf.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.211Z","timestamp":1789268707211,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd0b72xdj4b72ewg5xxgza2zvcdf.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 28436\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Tue, 09 Jun 2026 06:36:32 GMT\r\nETag: \"e59d5d37833da0a3e80cc69daf9343d2\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7773\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28436,"size_decoded":28870,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"e59d5d37833da0a3e80cc69daf9343d2","sha1":"aa331f8d7fc526abd23cec752b8dc84dd12a0c9d","sha256":"43f1b20156252e0d412959d6f76e6aea6632cf097533bd07c488e6c90df7fd39","sha512":"a62cfa37eacda38a46f4e5939b93477a68145a1581425748f3b4e0aa7fac5b5dd695bd627e7855827e7ae0bc7b1082ccf1ab0ee5471c94f26e4604476f612462","ssdeep":"768:IFRLdtwXep0DnKIXBRXeCDpNrpN19oYjUzZ77s1kKHvS:IvBtweoKNszl94F7sJq","tlshash":"5fd2d01f1706caebb2d158d4bab16f0d238669c9cb8733711984edca0ce359eed4042b","first_seen":"2026-06-14T20:28:34.071116Z","last_seen":"2026-09-13T03:05:55.550129Z","times_seen":37,"resource_available":false,"data":null}},"time_used":949,"timings":{"blocked":919,"dns":0,"connect":0,"send":0,"wait":27,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055uncsifdej58ndiz7jturjzvtk72.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.282Z","timestamp":1789268707282,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055uncsifdej58ndiz7jturjzvtk72.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 24074\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:58 GMT\r\nETag: \"3b6baeac2e7d0f44908e50533717ca34\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30816\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24074,"size_decoded":24508,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"3b6baeac2e7d0f44908e50533717ca34","sha1":"2977de9165fe414cde3271ef490e600c2dd64d0e","sha256":"a5f2f235455a46db0a6e84cb92cfe7a6bc4096fee94898798710ed3cece2288e","sha512":"8609f128bb74af1b6413ce2dda43d7aeb6f717e42b8111a6d6bda08c35e5e2e80ef886d0b2d8082781cde4ac53fc21da631585e75c3fba7f986d525ada83966b","ssdeep":"384:+TuBVvyBGUTb1OeuB9y3no66WNyeE2zNiO8JnGmR2HMTHs/0l6V6nav5tqCM0uXc:+Tumtb1Oes4n1NvNiOPmRvMFAu5tqTsn","tlshash":"d6b2d0469e2ff9b3d3a5bd7b883cd1801edaf66c0c58a35774a71401aa21f0c491adb5","first_seen":"2025-12-11T02:11:47.061576Z","last_seen":"2026-09-13T03:05:55.552868Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1106,"timings":{"blocked":1077,"dns":0,"connect":0,"send":0,"wait":27,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un158jdecjzorpxsgmxf0fyah0e.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.288Z","timestamp":1789268707288,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un158jdecjzorpxsgmxf0fyah0e.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 32275\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:15 GMT\r\nETag: \"573faa66ce264a31e4a12e34a7109648\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7785\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32275,"size_decoded":32709,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"573faa66ce264a31e4a12e34a7109648","sha1":"2726af4995e94d0965190854112d5420783a339e","sha256":"555d1ed9656ed731fabe6c51314b603ba3b409ea6d86afec412e504c2039af03","sha512":"e1b9166a32c83877ad09401cb96e99fad768e34dd93c3d9879b17eae7763eea7f31b09ae7a473b22e0b5ce57a7dcd602b1918820d86ac7ed46c27bea1a0e49b8","ssdeep":"768:TG8qIIoNWr4YqqkearQXasKmS6Nyv/r76iFaLrZzFVrvMv0:TnPFWhcrQjKqSHk3ZzFVIv0","tlshash":"25e2e1e816651427f2c30cbefd17b904a49246a7ab2b1ac531d8bb2533bf3e0df52148","first_seen":"2025-12-11T02:11:47.213738Z","last_seen":"2026-09-13T03:05:55.554093Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1127,"timings":{"blocked":1097,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00003.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.336Z","timestamp":1789268704336,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00003.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 35952\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-8c70\"\r\nExpires: Tue, 13 Oct 2026 03:05:04 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04h2Q194_46621-35445\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35952,"size_decoded":36597,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"ee483219e3a59a79115f852d1cfabb32","sha1":"213682a572ea57d053bd564cb4f7f586b7357e66","sha256":"eb648888b712c18ef950de79f0533c6246fe3881a895624946f9fcf1bd2dc23e","sha512":"8d37efdeac553bef671b782641b2df6d3aa5cc4df38087125ef066783330dceace8d799b9838afadb96ec7a331bab8ee4e53f324051392bc1ea6ab234cb8bfba","ssdeep":"768:QFX2OzF2Da5eIKvLEFiTs/PM4UF+SiUp3NODq01opgjwpUzheUiLafZX:QFdz4D/dTs3MnNXODYgjDz4UieR","tlshash":"5bf2e1cd783fa7fcc0146fb464343164c69f23a25c27a1567dc9f121a8ba2876881fca","first_seen":"2025-03-14T20:40:58.460696Z","last_seen":"2026-09-13T03:05:55.555186Z","times_seen":122,"resource_available":false,"data":null}},"time_used":808,"timings":{"blocked":-1,"dns":0,"connect":25,"send":0,"wait":782,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00025.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.380Z","timestamp":1789268704380,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00025.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 39586\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-9aa2\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23238-37993\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39586,"size_decoded":40230,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"f0348b3984b85957bb94897473d8687c","sha1":"c75519f2a9fbd1bca97a8b9b9295fa7c4b284d96","sha256":"760c2c5fbe652a31ebd9d9b65bfcd313e4f6fb5d9a765765015fc0cb9e6b994e","sha512":"b579f20b3834d620c244ba2e0c6bba7fcb6719e8d432bc6f5acfcf0e37e090286eb058e4e5db22249ecc2eee5ebc4e810cf81cfe2dfdfd570fd3572b6146609d","ssdeep":"768:0AcXKxID+cd82GDB5HC+i+Nr5AW64voURNlK68xddjx+GbItIbm0M:0hf+IM5ND64voEfK68xdj+UImbDM","tlshash":"ee03f10ba48883a9e8597c3407c92c6f1421dd9fd9ae1fcf5c8d32a4f6efa458173891","first_seen":"2025-03-14T20:40:58.483203Z","last_seen":"2026-09-13T03:05:55.556282Z","times_seen":115,"resource_available":false,"data":null}},"time_used":2376,"timings":{"blocked":2197,"dns":0,"connect":0,"send":0,"wait":176,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/right_agentCenter.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.782Z","timestamp":1789268705782,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/right_agentCenter.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 61134\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-eece\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_46621-35459\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61134,"size_decoded":61779,"mime_type":"image/png","magic":"PNG image data, 200 x 240, 8-bit/color RGBA, non-interlaced","md5":"0b1ab1ea2b0759f9ed390e558a1de675","sha1":"c894119159e0eac9d91104524355f05fce7fa2a5","sha256":"2766cb8fda0f444f620b904a0700fb4a5afcd39ed302b3fc24da2700f32e2e89","sha512":"719d71013b7f269cfdc88d00ca8f82b47bdb6e570cf180a9a197ec3581047fd61ed8bd4a14fa11302c18ae2e76561f843252b529a06600f0f26a2f4839f17ab4","ssdeep":"1536:5sLZu7Ie5iKGfpkkUXxDdjOS3feS95BVcCvBH5gIHVf:m8I6iKGpkkUXxDdeSNNBH5gcVf","tlshash":"285302f1cc948b002a68c35f5984fc3525a9f7c54cb748afb4b643003ab077ce6a58ba","first_seen":"2026-06-11T02:30:28.073453Z","last_seen":"2026-09-13T03:05:55.557208Z","times_seen":70,"resource_available":false,"data":null}},"time_used":1363,"timings":{"blocked":1174,"dns":0,"connect":0,"send":0,"wait":178,"receive":11,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1znsde2eerinfpsy400e03o85.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.251Z","timestamp":1789268707251,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1znsde2eerinfpsy400e03o85.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 35962\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:30 GMT\r\nETag: \"35be5dbd56b11717514872f070b2f929\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3230\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35962,"size_decoded":36396,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"35be5dbd56b11717514872f070b2f929","sha1":"f2bbded00ae815d120e0caa5f3764809f9b12fbb","sha256":"ef4f767ecd9ba746dd0d3849570b5671df52b31f3e9f64069cb40d7f6d759599","sha512":"4a74388eec90d7c8de281122c407d859251c1916440567ef0fffe6b558d03ce2dd94ff2e5f9e9e03962646e236a46fd0a4ebe1f23d98a0a7a18e86fc5a0edcfa","ssdeep":"768:nB6K9p5zFR47loFc52OnfwdKYKhWGJuPm6ruc4B/lHIXizm:nB5fxFrdKrsm6K2Xia","tlshash":"27f2f1a337874affd7509a3da527a2bb8235cf48f544f7bc262f8c50621d7597088684","first_seen":"2026-06-14T20:28:34.076447Z","last_seen":"2026-09-13T03:05:55.558189Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1022,"timings":{"blocked":992,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkspjbxmed430arluj3.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.257Z","timestamp":1789268707257,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkspjbxmed430arluj3.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 37809\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"3c7f35cdc735a9642a8e1c31b95b497a\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7781\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37809,"size_decoded":38243,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"3c7f35cdc735a9642a8e1c31b95b497a","sha1":"01790f8009ba15b4bf99a1e808c65f2e4a9cad2a","sha256":"5e01c0b0a8317fa7fe1c87473ea52c8c526da6615763721bb970ab990211ae22","sha512":"2e85e0c7c842b8e591d70f0bc42835eb68140365568875a4b068d7e36ce5b9204d954d622e489dafc534b5ff8aa0b31e9d1703ce890c64b6707d2fba2289fb6e","ssdeep":"768:nCmhGtTlUWqcNbLWy+APOFXwIGlcWfQHeI6Zaz:CmyliUWmPOFAcB6o","tlshash":"3703e05077334397eb15ffb8d4eb01abf961991d16a2a25cf084b02f04ef58e994827c","first_seen":"2025-12-11T02:11:47.118397Z","last_seen":"2026-09-13T03:05:55.559052Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1049,"timings":{"blocked":1018,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055uncsifdej4z3f8mko3u9vyfukts.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.303Z","timestamp":1789268707303,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055uncsifdej4z3f8mko3u9vyfukts.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 26744\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:58 GMT\r\nETag: \"edf5a50a9f2c5229b64ce02d174bbdd5\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2142\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26744,"size_decoded":27177,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"edf5a50a9f2c5229b64ce02d174bbdd5","sha1":"b244cd2a8eba8a64a3c509f1ad3f73409e2b4e13","sha256":"1cc1cfa8fdfa6b9b135315edd2af46fe18aa407dc299c80943ce507101eb3c99","sha512":"daf73e2a5f6942a8398fbcaa7fcae7c0a5e73b9366d5d65dde2c258e973b2678c4a9395bb9b21d5cc302435939df307f801a53003324546d25d87eadcb14df3e","ssdeep":"768:gcD4BQUjNkAN3mygx/HSBPYEr/dX75uqymyJEXUVmW:U2UBkAFeyBl75JlQX4W","tlshash":"0bc2e12203d2a536e025ee3f680654353705ec8df51a2ed3abb919993634b8d3f0649d","first_seen":"2025-12-11T02:11:47.223837Z","last_seen":"2026-09-13T03:05:55.559815Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1167,"timings":{"blocked":1138,"dns":0,"connect":0,"send":0,"wait":27,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/style-BAEGjb_c.css","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:02.464Z","timestamp":1789268702464,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/style-BAEGjb_c.css HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:03 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-654ad\"\r\nExpires: Sun, 13 Sep 2026 15:05:03 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612de_PS-CDG-04VRO197_23238-37967\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":414893,"size_decoded":88591,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"854a64bc6efdf299ce98907140720ec1","sha1":"7d629b446600edd9499964744a8806ef50e7205b","sha256":"a358e23f4705e1b3b4245ee0ca197ce05ccba951538091b6e41ae94c8365abf1","sha512":"5846113fc13bf9c1defc84a684f188a7a45d4297c169b8c118196f8cdbfbda464dee03a462d7b16b36d796907ca0729b7a7308a91b615862d2991fe51f182873","ssdeep":"6144:AG64xsAST3JBjk8tU2hN0GAIzIq/bjQywNAF6e/Lhmzn8YVvFrl4YRz7bbIex:AG6KFPt","tlshash":"38941b70a684543dfd3796bae2c8d69c691de953ef124bb6f6043810cac23ff2553826","first_seen":"2026-09-06T17:58:09.735085Z","last_seen":"2026-09-13T03:05:55.560616Z","times_seen":6,"resource_available":false,"data":null}},"time_used":953,"timings":{"blocked":-1,"dns":0,"connect":26,"send":0,"wait":772,"receive":155,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7krxcflue1z3wszh7d.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.192Z","timestamp":1789268707192,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7krxcflue1z3wszh7d.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 97646\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:17:02 GMT\r\nETag: \"3bcb528147e986cc69693f75e9af7966\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6956\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97646,"size_decoded":98078,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"3bcb528147e986cc69693f75e9af7966","sha1":"be3c41142bf68efb7a0fefca0fcb15569fee718d","sha256":"14473bad8864fb3dba882582ab9d22ce53e35a4e6cf9973d9531a389d2d78501","sha512":"b9988d5e7f0ce1aa360ffbb8328ec401340c94ef5674682e0fb8f6a789d551bd42818fbf76fbaaeb5486098c0d65bf5bd1b55d121adad8daed3a150cc906283b","ssdeep":"1536:1tIUN/TC6P66tQMm6jGUi6IT7vshFQAGGrwn6n0NES40R+2LC7VpCzaevqQlQSsE:1tDN/Tl66RcUiYsnQCg2BqdEmoNR","tlshash":"0b9302c4992cee8992132be7c7f0a956e70a5be40121129440ff778ba08dd91739ff76","first_seen":"2026-06-14T20:28:34.041399Z","last_seen":"2026-09-13T03:05:55.561274Z","times_seen":37,"resource_available":false,"data":null}},"time_used":924,"timings":{"blocked":887,"dns":0,"connect":0,"send":0,"wait":32,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1lc2ddvdmml2n1to7j087xybh.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.250Z","timestamp":1789268707250,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1lc2ddvdmml2n1to7j087xybh.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 95805\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:20 GMT\r\nETag: \"2c5d002c8917f2060b8130fdca76ad3f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7779\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":95805,"size_decoded":96238,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"2c5d002c8917f2060b8130fdca76ad3f","sha1":"66d21ab0956fe471bd41be44acac1c4b3be3bef1","sha256":"d62ea2cfb908b5261f540227cd78ea6d7bb7a58871787dd967858d0b28f136e3","sha512":"8a25cb32ff791d1c3af7e1cf8f7ed6ec452271f8345fa2785d9921b0563db135929d7a938ac9a45116be88d0fe5076403ca63b375a4df0a77544cc467652ac0f","ssdeep":"1536:BJUm15kBapfImMUEcXr/Q1pFte/bzUAIyYnDtwHGR5BlhqZW2J3FGiLPhGoaxvay:buxbir8Xte/XH8DnRhhqZVJnLPhG9xvF","tlshash":"b39312702a1da49c7fe90484e083cb421585c9b70ca2dd4ef7b54686bb11eb0c9bf4f2","first_seen":"2026-06-14T20:28:34.271798Z","last_seen":"2026-09-13T03:05:55.561984Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1021,"timings":{"blocked":987,"dns":0,"connect":0,"send":0,"wait":28,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedllmq5i4oq9c0n0mkbf.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.340Z","timestamp":1789268707340,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedllmq5i4oq9c0n0mkbf.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 85309\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"99c50f4dcbbecd59bd251e80f6501008\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2147\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85309,"size_decoded":85741,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"99c50f4dcbbecd59bd251e80f6501008","sha1":"ad69a810dc90b36d0883c3738075a6a83f2191f4","sha256":"28705e7f94bd01c521c946e03d824695f83992a8444b238520d1ab48def936a3","sha512":"dfdd3b9854159c502ef18503ab158e239585eb9d74f226f3dadecb5375d36418cb8403656987c41272f3c2534c3950a44cec6c13238078418e90a7c56c50eda5","ssdeep":"1536:QDQZsW7/baNvxdh+O5/6URa65lDwS31G6BrpnyhttI7ww+oF8OO19:BZsWaN5XnB6UR956mGY1yzmy","tlshash":"7383126360f8acb290d1f012d89c1d8b369b43ad2664f770b748bbef426935f55910f9","first_seen":"2026-09-06T17:58:09.666705Z","last_seen":"2026-09-13T03:05:55.562524Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1281,"timings":{"blocked":1246,"dns":0,"connect":0,"send":0,"wait":30,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7i3quz0uu10p0q7myx.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.198Z","timestamp":1789268707198,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7i3quz0uu10p0q7myx.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 103559\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:13:32 GMT\r\nETag: \"db05cf6ea06d2564d77b94c26a69f7d7\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7772\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":103559,"size_decoded":103993,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"db05cf6ea06d2564d77b94c26a69f7d7","sha1":"509753dcb0aa71c13992c858dc738d782715ef47","sha256":"fbde71cb6e77093bdb1cb39c7a2b5cf4f26e9ef49453f7163fe3fefcd04f3d85","sha512":"277f010ea418c30107fac0715b53b8f14ad48684b483688fa3fda1665f8e441134a13ee9766e3c17b3a80d58ca9c2a0ecaeff25256634d8a2133a095878a8e8e","ssdeep":"1536:4bjH6A+4LU+NINSj9zdLY9l4WkFO04ONmIh/SMcJDahIcwmIV:43aJ4LIcj1dsRAmIVcNayDmk","tlshash":"60a31229e5e370f3e109a9d9a796013a3f20d1a3af676e57056f304d603e38109e4bf6","first_seen":"2026-06-14T20:28:34.207313Z","last_seen":"2026-09-13T03:05:55.56311Z","times_seen":37,"resource_available":false,"data":null}},"time_used":946,"timings":{"blocked":910,"dns":0,"connect":0,"send":0,"wait":27,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7hbvl9ivim1o0wd2zmm.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.313Z","timestamp":1789268707313,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7hbvl9ivim1o0wd2zmm.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 50201\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"848af95ab7b9d7b611ddc44893baf570\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33031\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50201,"size_decoded":50634,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"848af95ab7b9d7b611ddc44893baf570","sha1":"f62341dc2c2f2434f467d545682bd864b40444ca","sha256":"f1b738eab030404fbdf66aa5759f5de1a0f7f8afaa9d70a168881742e2514b09","sha512":"b3f2204a4fd0b53386b6029f9d5bf7a9fca916b380b12f08c8e77dd93dee52a3bba2ca6cbec562fd9384fc7d04a918f970008de877d5cd61985f46d0d27d211e","ssdeep":"768:2LrzoL+ZeRK+ZCyXg3wSO9FCucJ17HmVB14jXY5a425rpc2PCjYtNcF1y7XSGO1h:2kLvKaC/TOvCx1riEaaN5tBla1f+Sd","tlshash":"4c3302f7cb30bdb65216cf94aa5c748640f940395da0b6f6f5d4bb08c3f2e1604e849a","first_seen":"2025-12-11T02:11:47.374872Z","last_seen":"2026-09-13T03:05:55.563667Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1212,"timings":{"blocked":1181,"dns":0,"connect":0,"send":0,"wait":27,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd026cfdibgs83pkhwjlpo3cpgrm.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.838Z","timestamp":1789268708838,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd026cfdibgs83pkhwjlpo3cpgrm.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 52100\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Wed, 06 May 2026 08:51:55 GMT\r\nETag: \"c7ffd55cc3c6141ab3667df844eb679b\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30827\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52100,"size_decoded":52533,"mime_type":"image/png","magic":"PNG image data, 284 x 284, 8-bit/color RGBA, non-interlaced","md5":"c7ffd55cc3c6141ab3667df844eb679b","sha1":"5a5d2451361ae248ca11aac247f91946cca215c4","sha256":"cbe13822b8014a9cc9b0588d6848b7577690b7d4d818fd8ff942be2817c79421","sha512":"bfe1dfeca8449e43f066d67c9512960b5bcb8b6869120547608ce5d36fa612df0d5efb96ecf3e5dfe4aa4d7706a69dbe88f44b89abde27c6e2c5dde6156fe4f6","ssdeep":"1536:6OTjNH/LyRU6QTkU8WGOzszU8JB148Pp4bPpfJmpw4Pu6oAc:TxAQTgxOzEfJBMj4Pu6G","tlshash":"76330267ebca74edecf9157118a8a04cb4bad4a207b39dfd926e5d68330c3f60060275","first_seen":"2026-06-14T20:28:34.251368Z","last_seen":"2026-09-13T03:05:55.564221Z","times_seen":37,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00026.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.381Z","timestamp":1789268704381,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00026.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 39650\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-9ae2\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_44919-40723\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39650,"size_decoded":40295,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"014fbd0c8279a9855cddd74b74db0a4b","sha1":"5c8e4063696b3b88bd9e0d273fb29ea8ece48caa","sha256":"a0ca0be4439f08eba980e9002c84a6f8d64a0c71dfe56c6bb21ad07b61e7c07a","sha512":"fd5e1130f7cb821122ff6ec4da94498dee7221b527430228d1eb1b12036b1a85b355330da0df5057f2b3e186a145f9aee455dcf5d07b8f3d2e56157780fcfc4d","ssdeep":"768:lSZ5CW9VnEFap5qzbb0ExGXaQnUnBRVtaOPozB/PnCASnvUB+iduzG:YZ5CWrnaa7qzPfxgGRVpPoz5CKB+auzG","tlshash":"0f03e12867b0f2fc9e9be4f2b2afd502f4da34342f79722705601a0927d97ae44bd504","first_seen":"2025-03-14T20:40:58.48405Z","last_seen":"2026-09-13T03:05:55.564918Z","times_seen":114,"resource_available":false,"data":null}},"time_used":2403,"timings":{"blocked":2215,"dns":0,"connect":0,"send":0,"wait":182,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/launch_app.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.822Z","timestamp":1789268705822,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/launch_app.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 55936\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-da80\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_46621-35452\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55936,"size_decoded":56581,"mime_type":"image/png","magic":"PNG image data, 375 x 375, 8-bit colormap, non-interlaced","md5":"16c36e52f4664ad7a8f257c8444f206d","sha1":"5abc3277e3c0edb5f3560520dba19122fed5de93","sha256":"b7f7c863a352087f73617b60c90b7c83650797cbc8c670627a2c7ce1543930a7","sha512":"23676b6eb319be7a4cb65f5bf676d4b2168477691288ebfd9b98c77a2840f3b9dea6c9afddb06b5b59e60927a26bacb073661757a549b903c7c08dfccf71007f","ssdeep":"1536:VqNziGNWgNLdmzXk930gXdnPj2ZH1CS+cJ:kTUgNL0Xk930gNnyZVF+cJ","tlshash":"d743018067e93e89ca0336b4266e2456c7dea7306930a70b320494e198ef3db75c3a75","first_seen":"2026-06-11T02:30:28.049481Z","last_seen":"2026-09-13T03:05:55.565525Z","times_seen":83,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":48,"dns":0,"connect":0,"send":0,"wait":179,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un289ede78mfqy476ldd0ovmhy8.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.294Z","timestamp":1789268707294,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un289ede78mfqy476ldd0ovmhy8.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 50683\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"ae96fc91e5078ac04f6f6061a7506698\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33029\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50683,"size_decoded":51116,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"ae96fc91e5078ac04f6f6061a7506698","sha1":"2ac5b47cb0a2cba9db71e04bdcc4e3f21d695dd7","sha256":"a96582b3cd0f02104eb8b606e657bc473b2e3b58f16737c28deed0ace3b6e397","sha512":"7732d48f17ed1ac28d37ee42ef4ae0aeaa4450706a5366871cfcf474845706b96d29fcb10a8f3e36d0ff9dbed47fdaf5bdfe671a108eb3bb35e9614f66c92182","ssdeep":"1536:rWJC7YP/IDFF9RP25mRVNVhVYF6P3MWIg7b6ZfqFqtxmMe:QuF3RVNVDYEP3b7bcRWMe","tlshash":"89330223aa05f52de8fa3d701cffcb4b6320765c4295508375a25ea05f5322d2a6fe6c","first_seen":"2025-12-11T02:11:47.229379Z","last_seen":"2026-09-13T03:05:55.566116Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1152,"timings":{"blocked":1121,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00022.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.377Z","timestamp":1789268704377,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00022.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 33208\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-81b8\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23850-31936\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33208,"size_decoded":33853,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"bc4f32587e17661fb0721c2aa5a959a8","sha1":"b1171eff54e56d179bc8c803812a54ccd8d9b31f","sha256":"099e452b70444c84c67ad4bc6d6403acabf73abfb3de0c2326def43c05356dc9","sha512":"701a854b5af676cf11ebcb756fd5febb4b0e081566a4b00e252d05c3503c1190bd8bba5f5346ffde2181ef2232586b313e5b7f447412335f83fbdc8b2f79ef0b","ssdeep":"768:tJGqQtqbNSdSeEmRvCKHibybBTeY9weyEjxlD68r2E:tYdtqb59jy9eYnnDvCE","tlshash":"cbe2e1c7814d869bf8da09b94d61343f521561fdfab85644a8e0c1a3158ff408d3df1d","first_seen":"2025-03-14T20:40:58.514546Z","last_seen":"2026-09-13T03:05:55.566705Z","times_seen":117,"resource_available":false,"data":null}},"time_used":2253,"timings":{"blocked":2066,"dns":0,"connect":0,"send":0,"wait":186,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-y3yWNOcx.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.449Z","timestamp":1789268707449,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-y3yWNOcx.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-f24\"\r\nExpires: Sun, 13 Sep 2026 15:05:07 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04koU196_50640-6040\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3876,"size_decoded":2395,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (3875)","md5":"ae1be571044ffad688f8901190aab953","sha1":"7b732dfca8ae0ce06ff8639bee9fb05d9a706ff9","sha256":"c1073428906f205323cdbddf3a17526b10f1fa5d25472453cac1b3be7e0af4dc","sha512":"5f3862f6f3a8567c7c9ce81ed5fc7b0c488d70bca4975f7c8c901d4b8a88bc2e1e21cd4fde390f27d5792ced2a65ed14834faa44b773164500822d07077aee1a","ssdeep":"","tlshash":"8381f8153ce9747193768887c0e70608e7796339a23ff8dbb789834138544ef974262a","first_seen":"2026-09-11T22:02:29.691579Z","last_seen":"2026-09-13T03:05:55.567317Z","times_seen":4,"resource_available":true,"data":null}},"time_used":178,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/channel/g9kdwd010qfdhm0djvrwdugv00iu50ia.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.096Z","timestamp":1789268707096,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/channel/g9kdwd010qfdhm0djvrwdugv00iu50ia.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 159809\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 06 Apr 2026 10:49:14 GMT\r\nETag: \"4bafa14da893667519b5526018555ffe\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_22295-30804\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":159809,"size_decoded":160243,"mime_type":"image/png","magic":"PNG image data, 1420 x 499, 8-bit colormap, non-interlaced","md5":"4bafa14da893667519b5526018555ffe","sha1":"45e51effbf4a9105938d7f616633d88554458db3","sha256":"7bd41600a96f3cc4c3b44290592b57164477376d443f5a68689fe2e9465a0b15","sha512":"5ff2b965c8c4d7a2b0587dff1618a613e51df4ec08dbbcd80f6ad938ac9025220602b5c3b4416928d07cd3eefd198a0e318e7e1339e7a4754705c24c9fb2c64f","ssdeep":"3072:0cH8M9WW0+5ZXNsSv9pIZAbQaZejeMDVREjbC+FWIJL3eMuAbVWetyV:0cH6l+RDnPrZpyRcbvLXnVWii","tlshash":"22f312f77d0239a519099c35cd23a871863f1d280af1ed61f4e6b2b5e6ec81d64ef224","first_seen":"2026-06-14T20:28:34.280932Z","last_seen":"2026-09-13T03:05:55.567895Z","times_seen":37,"resource_available":false,"data":null}},"time_used":966,"timings":{"blocked":0,"dns":819,"connect":26,"send":0,"wait":28,"receive":58,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7haxq63yeo150ph07ec.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.315Z","timestamp":1789268707315,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7haxq63yeo150ph07ec.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 54290\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"5f7462a6fff9187edc975e17e0f7f122\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3238\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54290,"size_decoded":54723,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"5f7462a6fff9187edc975e17e0f7f122","sha1":"d187005d679d45b416203595b89d9af879d42f8b","sha256":"dfb00aa849c939b6f9bf034be361de27fa52aecc74dded66db95b3982cf74678","sha512":"b8aa7f94cbd624d9f7263ec72c35094bb80fae9aca9f315b878367d93bceb8279ecd3b3987e42fde3609ac7697983f2ee9851026b35645cb578088513da3a54f","ssdeep":"1536:WZuRfkI8y/vxAwkHFYyyNXO52WSy1XLaAsIE+BLIUF:W4xkIXQ4erSwXLaAsjgDF","tlshash":"6033024edaaa0c75c89076610d01fc8bdd9392779dde5d64cbbc9434f7b601bbab4840","first_seen":"2025-12-11T02:11:47.350403Z","last_seen":"2026-09-13T03:05:55.568639Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1217,"timings":{"blocked":1185,"dns":0,"connect":0,"send":0,"wait":28,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.427Z","timestamp":1789268707427,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_28184-12009\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":442,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":690,"timings":{"blocked":449,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/popup/list","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.418Z","timestamp":1789268704418,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/popup/list HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 4fc4635168c2d418e0a6b35cd7a63c55\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04uki195_56153-3206\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":718,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":935,"timings":{"blocked":401,"dns":0,"connect":26,"send":0,"wait":479,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9t8maat6m2hs0c6h12s.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.238Z","timestamp":1789268707238,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9t8maat6m2hs0c6h12s.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 68778\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:44 GMT\r\nETag: \"384bedcbd3214ace97e9431cb0b04e4f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2135\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":68778,"size_decoded":69210,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"384bedcbd3214ace97e9431cb0b04e4f","sha1":"3c04b3f944edbc2f38e12876594a25eeda658205","sha256":"c8f016af6b66772a4deecabac896393b904574ffb5f65528161c1b12abcfc068","sha512":"56d9cf252a620d6e2f9f289e87e99c1fb78664deefc2bd087cfe2ac5cd4e8a7205a332fa98da8a78c3d5c597774e093ed1c1b5b8ba43402d44420ae1b351eaa8","ssdeep":"1536:mcr62KwAQIIj6Wuwuxw8cHFF3Gxf4p3OinG+S5eMFjLhF:mcG2FAQxj6WgcHFF2m3Ln25nFjLhF","tlshash":"2d63027218974acde183e2401a61d1c0f52d7e78ff6a49e3eee37d8f1b426c6990194b","first_seen":"2026-06-14T20:28:34.290583Z","last_seen":"2026-09-13T03:05:55.569198Z","times_seen":37,"resource_available":false,"data":null}},"time_used":990,"timings":{"blocked":957,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdee1tsxh5yup3jy1b5xv6.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.317Z","timestamp":1789268707317,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdee1tsxh5yup3jy1b5xv6.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 61527\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:54 GMT\r\nETag: \"04f7a30a1c211b946b5bb21ac250172b\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6973\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61527,"size_decoded":61959,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"04f7a30a1c211b946b5bb21ac250172b","sha1":"b12e8fd2114fffd1572af0f02fbd57dc9fec29bb","sha256":"fb6ad530d1faa78138f6d48c28327c3fb3f2367eb5cfa8c47b528c43b6414f57","sha512":"8ad723c174b4ca188fb36b5de9e20b30a755a4af40f2531998760e678be9d50c5d1c21138feb9478540ab0ddebd514914532b4807c180c681a6b6714599ba1fd","ssdeep":"1536:+IzVSpqvyp1IVLjWc4trBhex7zIg8bsuLoJBdbg:75SpqaHSLqcgrBzB6fbg","tlshash":"6b5302f69c43477a45b16567ed8502fbffb8c46e0834484a09a8eebc811b5f43cd4e22","first_seen":"2025-12-11T02:11:47.15725Z","last_seen":"2026-09-13T03:05:55.569966Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1218,"timings":{"blocked":1186,"dns":0,"connect":0,"send":0,"wait":28,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00006.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.339Z","timestamp":1789268704339,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00006.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 37138\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-9112\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_46621-35448\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37138,"size_decoded":37783,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"a3ee7da6a835d5e0f8371164fbf91612","sha1":"1935fab01f8abeed050534a26e736ddd214d5300","sha256":"f233fb22506bba6be0f5c71189f1f68738227104c4e7d15b93b2aa9f0c6671b0","sha512":"759cc01ae0076728491da3fb74a23dc2ebe22c1b5cb69ab8aabcd28d2b2bd305cba85334a07aaaabe35804fc2ff6d443c958a35f52fd3ba81da04f3b592adeae","ssdeep":"768:YclHsK0WQsRvkO6Wrv1J4wJQIA3arx/TdHHAs2AWdc:Y0HsK0WQ8nL740GarxbNHlvWe","tlshash":"4df2e124728849bffe48f0764ef44d54a24ac87aeaf074d76c28168c3b0be5df656215","first_seen":"2025-03-14T20:40:58.569063Z","last_seen":"2026-09-13T03:05:55.570481Z","times_seen":124,"resource_available":false,"data":null}},"time_used":1131,"timings":{"blocked":947,"dns":0,"connect":0,"send":0,"wait":178,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/option.vue_vue_type_script_setup_true_lang-BXULlH9N.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.412Z","timestamp":1789268704412,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/option.vue_vue_type_script_setup_true_lang-BXULlH9N.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-8aa\"\r\nExpires: Sun, 13 Sep 2026 15:05:05 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_46621-35447\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2218,"size_decoded":1727,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (2201)","md5":"61433b4de1ca3c292aef64962abfe8a8","sha1":"be3f48d9205b836ca25a8e7084c815d3594309d8","sha256":"69ebebbcf8f9cc30ccf43d4c94d6aa8251c2f998d11ebf74b0a179abb496a813","sha512":"8adcbc282e5dcc24a7fb89e9566b299562b4bf3a151391069346662e20e1e134b719ad416f9be239a94f4ddf95bb7ca2d202c4641c204a387e298130014ee538","ssdeep":"","tlshash":"4041b7fe5695c46240721350e678a89422dcf5c8f611474a73f67d215d85db1332e6f4","first_seen":"2026-09-11T22:02:29.337993Z","last_seen":"2026-09-13T03:05:55.571166Z","times_seen":4,"resource_available":true,"data":null}},"time_used":900,"timings":{"blocked":721,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/support.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.789Z","timestamp":1789268705789,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/support.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 688\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-2b0\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23238-37992\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":688,"size_decoded":1333,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"26d30164dac4a64ae12adcaa960ae515","sha1":"dda84365fd771bf519ffe2a9f5d25328d521e6bd","sha256":"7895fae1dd3413185518b2274985572b95948f65f13f19da0f22c3f7f5b731fc","sha512":"cfa899fa33a72ef99407a1f8a9553982ec41dc28805ca9d022fdba9022f661ac798a519e4e89e9eefd9be5be5587a0a2cd20651cabb2d79031608b863fb3751b","ssdeep":"","tlshash":"e00199fb08bc255a818582c0bbdb17485f6cf38bb21815dab38060552e340bf72ee606","first_seen":"2025-12-11T02:11:47.235289Z","last_seen":"2026-09-13T03:05:55.572298Z","times_seen":77,"resource_available":false,"data":null}},"time_used":818,"timings":{"blocked":642,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlko9gdzem8y08zf9zj.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.334Z","timestamp":1789268707334,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlko9gdzem8y08zf9zj.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 74179\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"8712d049c9cf3be97ad47022291c2b04\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2146\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74179,"size_decoded":74611,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"8712d049c9cf3be97ad47022291c2b04","sha1":"9cb19c6cb91f53256346fd3acf52d84a1b8276cc","sha256":"144af0c8e9cf4bb7d6720f34f1ff75871d850579571fb2bd8ec378a0ec7cc0f8","sha512":"4dbecca6758478418b54395461682c729a737d46800353cc86e81afe5538faf6ae8c6589fc9c759cdafe968d9271bd84e851fc988c6c9d44e3664b711a21d60f","ssdeep":"768:eXh3GZjHPNpF2gsD4/8Ca+1P4AkWGINBx0A7tn9z2/NLXgtbdqbs3DrcTh6T4e0B:eXZEJbsT+h2Ix0WnKNDcdNT4e0sGr/gG","tlshash":"9c7312f0af0f4de8966cc89edcf5d6de5a1a2e883b05acbb222e345c3845c59c845099","first_seen":"2026-09-06T17:58:09.646276Z","last_seen":"2026-09-13T03:05:55.573073Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1246,"timings":{"blocked":1214,"dns":0,"connect":0,"send":0,"wait":27,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un21ltde3fr7yunxgeg000vfctr.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.813Z","timestamp":1789268708813,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un21ltde3fr7yunxgeg000vfctr.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 5477\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:37 GMT\r\nETag: \"c513cb841961fec7b602633bfb7ba309\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3244\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5477,"size_decoded":5909,"mime_type":"image/png","magic":"PNG image data, 200 x 100, 8-bit/color RGBA, non-interlaced","md5":"c513cb841961fec7b602633bfb7ba309","sha1":"3608105c80282af96434d6c0296976444dbe81cb","sha256":"0698264f633bfc4e70684ea73af62f09206b05c41db56746d69cb2c77afd4609","sha512":"f512f6fc34418b504238bd7bad8fd7b0cd6ce0636e7f6a3eef592b3b51006ddae322505a48cf00f3e34e9a71e12814dc961e6c8d40ca0d64ce31f4b59aa132a6","ssdeep":"96:6z7S8QmCPB3xYqMHyo4Qr0c3OcOZyJ1bYOYDrxhUoY3v2fiZbz+22:c7S8SB3e9HyzQr0cecOZy78OgNf5","tlshash":"37b18cd65ea0c2aff6c9b46c76cc52209a11017be3a25413fbc280a4f10bb5c759f244","first_seen":"2026-06-14T20:28:34.305784Z","last_seen":"2026-09-13T03:05:55.574033Z","times_seen":37,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqjp1hvtohr0jziyxw7.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.855Z","timestamp":1789268708855,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqjp1hvtohr0jziyxw7.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 10652\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"0b43f2c69f5e2926140f8d1281cd231e\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04uki195_56153-3253\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10652,"size_decoded":11085,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"0b43f2c69f5e2926140f8d1281cd231e","sha1":"fa2a6218b594707391af8a523fd43106ed177619","sha256":"778257ede14fe09b54d43b5d35bd28defbcbdf9cb8395fb53bf183c7cc76797b","sha512":"af8743e25d3aeee60447be23015221e1c14d97e61b2e725aae3c83f3d484d80a5cc02c72fa9aee85470ee477cf147ff8a4e320665a01c2e562ccc2b56e592b18","ssdeep":"192:hDK5q3NIq+fBcUGLvgFt06KDoTOaTj6hxqBsPWm516z2YIJlEy6RmuvgdF18xWbZ:RYq3NJ+ZxFlDBTmTft4bIJQRmvFYW/vN","tlshash":"fb22c0f0437ee817d81032f4d90fbe561c573225126f067e7aecb7a246a30b5a2b1981","first_seen":"2026-06-14T14:24:21.485494Z","last_seen":"2026-09-13T03:05:55.574689Z","times_seen":43,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":171,"dns":0,"connect":0,"send":0,"wait":27,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7ipiyrvbj167m83kf6.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.220Z","timestamp":1789268707220,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7ipiyrvbj167m83kf6.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 107566\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:14:19 GMT\r\nETag: \"9be2e5c9eaf0ba83802c267426ca6ac1\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7774\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":107566,"size_decoded":108000,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"9be2e5c9eaf0ba83802c267426ca6ac1","sha1":"6f94f550c6fdd122baced5509c3a949539c8b249","sha256":"8c80c9b17fde5c807d298dc0939c667bad0e5cfc405ae3375b7c4ad7b340fcc8","sha512":"570502e36fd84b21b16a47944567cba9ef819b429d76cff27a8daa7f169519c7fdc48cd968c45210978c5c748cc9cc50325116839d7ea1c84a777f5a06a321ec","ssdeep":"3072:At+yQ1pafppBGECluHTcbm8ibnpXsm6vS0fz:YdQ1Q9GeAbmjpc1as","tlshash":"7cb312d42273502bbb8d1553b8aa98834d20ddabf4cef16758cd1f32f8528e7ac5524e","first_seen":"2026-06-14T20:28:34.04913Z","last_seen":"2026-09-13T03:05:55.578547Z","times_seen":37,"resource_available":false,"data":null}},"time_used":963,"timings":{"blocked":927,"dns":0,"connect":0,"send":0,"wait":27,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055uncsifdeikq5pcbqg1998c9lt8v.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.844Z","timestamp":1789268708844,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055uncsifdeikq5pcbqg1998c9lt8v.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 7069\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:58 GMT\r\nETag: \"576ceca2ef2daff0460d8dfa2b24b041\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33038\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7069,"size_decoded":7501,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"576ceca2ef2daff0460d8dfa2b24b041","sha1":"55a00ed099e8247dcf5bfaa08c6f9ee1fc9c0c30","sha256":"ed6954cdf91a95b474be1ad6b0e648afcc436aeff90479ebdba42853cf5b9166","sha512":"f6b9c2ae9923ab8a0d1659e8b67d1ae21c0dfb5353b6226b8cfa7fee4fc59382763b5e65f061d00841a52add9f3b3eb0723c1ea9c914d1f82ab5f5e6516bf4eb","ssdeep":"192:B8iRXwntT6XwVexXkF+ICqV/KyBDWYuMUz:y+gtawgx0cqVkt","tlshash":"8ce19f8e427b283bf1e7bc39182415029195da95aa7cc7f4c75010f78d31fecd6a11e2","first_seen":"2026-06-14T20:28:34.222214Z","last_seen":"2026-09-13T03:05:55.579191Z","times_seen":37,"resource_available":false,"data":null}},"time_used":44,"timings":{"blocked":17,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00019.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.374Z","timestamp":1789268704374,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00019.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 25926\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-6546\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_24105-30059\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25926,"size_decoded":26571,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"cdf65bb2b28afadce96a2c8862a28701","sha1":"91c904bc7b0160fa8372fb52be420405f9cfd95a","sha256":"1e42f1aa36c6039dcf71b4379e2422de2edd7d93be6d888f9def315ee316af1c","sha512":"8b8282aa8d55f539f9ebc3d46a3c78a1d730f44c887f23882d41e8b553ac378c37287b71b810afe8f609d3bd1ee6904ffc918f6fcd301a27ee1eee89659d66b4","ssdeep":"768:DT6LlYUTCWUZiYAOtBdstopwbOxloA5NL2CchtRcjy1K:SZl9UZiYAgBYhrhz2y1K","tlshash":"00c2d1da01451f43c009283b9d35790c9757ea5b3983af7037864fb22e432a5e87d8af","first_seen":"2025-03-14T20:40:58.531025Z","last_seen":"2026-09-13T03:05:55.579834Z","times_seen":117,"resource_available":false,"data":null}},"time_used":1486,"timings":{"blocked":1304,"dns":0,"connect":0,"send":0,"wait":178,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/mapValue?gameId=1\u0026key=oddsType\u0026value=Hongkong","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.442Z","timestamp":1789268706442,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"GET /uapi/game/mapValue?gameId=1\u0026key=oddsType\u0026value=Hongkong HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268706\r\nx-cq-sign: 995c9491129ba42a7a5f19a6d98476da5e0e9c8a6414e7a6c5d9d676ce26c8cd80ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nCache-Control: public, max-age=5, s-maxage=5, stale-while-revalidate=5\r\nCdn-Cache-Control: public, s-maxage=5, stale-while-revalidate=5\r\nTrace-Id: 6491e4a768c2d4186ea7b35c0def2a61\r\nX-Cache-Key: /uapi/game/mapValue:c5b0ee0d7caf66179d7b7778e39330c1e857ad9d\r\nX-Cache-Status: HIT\r\nx-via: 1.1 PS-CDG-04uki195:35 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_2046-65487\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42,"size_decoded":952,"mime_type":"application/json","magic":"JSON text data","md5":"a0059d9d4246aa3226a8b5c47f64a27b","sha1":"f564b699226fcd9ef2ad77ac2b8141a140696d3b","sha256":"dcd538f8e247fd71e7c79fab7fcd85043d99d82dec75964e0a6876b74b0d8e77","sha512":"9f5c80313318d51ab3798af99e5dcf6bb2ceb74bba70edca35aca8ff3179d4ce5ec31587efc5fe92cf8df52c66323d56cbd4b5a574d6d726ea210782c230c0a8","ssdeep":"","tlshash":"3d90040035141c3517034045340d1004f7d414444c441453cc7cdd5c5f45c141313570","first_seen":"2025-12-11T02:11:47.41562Z","last_seen":"2026-09-13T03:05:55.580479Z","times_seen":40,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":13,"dns":0,"connect":0,"send":0,"wait":185,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1edrdecm89yqient2860qvh8a.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.259Z","timestamp":1789268707259,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1edrdecm89yqient2860qvh8a.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 71855\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:19 GMT\r\nETag: \"96cd4f2e7f431ebc3990cdc6b6de00ae\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3231\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71855,"size_decoded":72288,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"96cd4f2e7f431ebc3990cdc6b6de00ae","sha1":"4c84279ad65ce3f2a89ee8e005840a6754a237c6","sha256":"423a52fc3f089c749578f53f371f4af7e59226a17d902f33eab8a9b5849c8238","sha512":"17e231d8e81fe6c058603097e14aadf9e0b9062b7302e61789dc93ce6065d883dbaac56b1aaf33ce3787dd4f14cd03a6b8c73d5b17076f8de5d12091dea11e37","ssdeep":"1536:5xtAqSuGMAweEAY+dp4patY/yTC1SSXFjNXuJyFdbzecAGI6mAHQQLMjBJCxDeR:5xiqFGMx/idKatmylWz+gFlzC76D7osw","tlshash":"a363120ab9353704a2ccde326c22703ec292f48558b13dc1eac95b7a47355a2f6576bf","first_seen":"2025-12-11T02:11:47.099666Z","last_seen":"2026-09-13T03:05:55.581134Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1053,"timings":{"blocked":1019,"dns":0,"connect":0,"send":0,"wait":29,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00027.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.383Z","timestamp":1789268704383,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00027.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 38729\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-9749\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_24105-30070\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38729,"size_decoded":39374,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"1d7e1b3440960286ffdb94fca678fd66","sha1":"d8b9d0ef044ca3ffbb67773e5390eeac6d1ad999","sha256":"fd196732ccb88d589705096d657c8767c2f92b11ef070b8ae47ff89318efe854","sha512":"cd16d3dc6a0cba4016971bc5191342932ab139144ebd6aee224688f9637fd8572e29af4efdb0e565bfc12a32f68dc84c814a4094d7a599a0016cd8c8f57dc593","ssdeep":"768:NpFf5Tz+u/03RTAGy09yZKlS886TPD+nnOwDlYLt1pyHTP:pBz83RTCZgvp16j","tlshash":"5a03e19e71296aa4c4d37c705d45266dea1b1cdf74bee6384e96ac4370384f012933cd","first_seen":"2025-03-14T20:40:58.576995Z","last_seen":"2026-09-13T03:05:55.586198Z","times_seen":114,"resource_available":false,"data":null}},"time_used":2404,"timings":{"blocked":2219,"dns":0,"connect":0,"send":0,"wait":179,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-Nlp_YWaw.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:02.463Z","timestamp":1789268702463,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-Nlp_YWaw.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:02 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-401e99\"\r\nExpires: Sun, 13 Sep 2026 15:05:02 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612de_PS-CDG-04VRO197_23850-31907\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4202137,"size_decoded":1065563,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (33921)","md5":"96958dc2cdf3bc301deee11360ad738a","sha1":"00952fa69885cb4460f60a929dd311816f4965d0","sha256":"bccf80988e275f8fa3c4b71fa9b37a7b1558664d9dbc4d9ea7685e86814d3ba2","sha512":"0497148a4dc625eb34f4d64ed7558f57d64e52f8c84b21dccdaa9bc981b1b1e7792f7e1f7bd0a75c01c48ee21437b059a3c8390ad07fdb8863ddf7d9c21eb25f","ssdeep":"24576:+2Y3FohjJIhsm4g8sTjgvyG34X8XWkI/9DDmCtjXnV2WlPYfoUEG331OBcNTgcoa:vY1ohjJIhsm4g8sYvyG34X8XWkI/9DDg","tlshash":"c125e960b087e49253d68aa46caf1c91b2144c457848a8b3fcfdec19bdf58b5c6b7f18","first_seen":"2026-09-11T22:02:29.399936Z","last_seen":"2026-09-13T03:05:55.587017Z","times_seen":4,"resource_available":false,"data":null}},"time_used":1168,"timings":{"blocked":-1,"dns":0,"connect":26,"send":0,"wait":348,"receive":794,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00004.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.337Z","timestamp":1789268704337,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00004.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 35616\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-8b20\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_24105-30056\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35616,"size_decoded":36261,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"8939c0950d5e615feae3c4fd2aaecca2","sha1":"1515148c74e82bf8c552f3b1bdab587a4124c3af","sha256":"c94891f908555a8c7ffedde452f4de6a69e142b6f555458fae2ca2ad906b28ef","sha512":"aaadd3b974d817cb56487353146a27444eb5a671a98bd30881265ccf33fde5dd6905ef972a16c7dbf45fcfb6c346e8329fa45105e7ae0928307506b7a7b9c7a8","ssdeep":"768:W5Umk9er8tN1ykt1kDN7s8Mk5BkHa4CqYLld3/UUZm2nxNhx:W5UUrkMkPUQw5BmodvV86Zx","tlshash":"00f2f176c1307d60cc8818960b4865a4757be40f799efcb1e2d26d08c593fa59e4bee3","first_seen":"2025-03-14T20:40:58.456178Z","last_seen":"2026-09-13T03:05:55.595731Z","times_seen":124,"resource_available":false,"data":null}},"time_used":1156,"timings":{"blocked":826,"dns":0,"connect":0,"send":0,"wait":179,"receive":151,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.958Z","timestamp":1789268706958,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 171\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":171,"data":"{\"type\":4,\"sportId\":1,\"leagueIds\":[17663],\"current\":1,\"orderBy\":1,\"isPC\":true,\"oddsType\":2,\"beginTime\":1789228800000,\"endTime\":1789660799999,\"languageType\":\"CMN\",\"size\":1}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nContent-Length: 97\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: 46a26f4bdb17b167e\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_28184-12001\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92,"size_decoded":595,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"e4662bc44588377e782fbce985062799","sha1":"2987db379501adc2e2bca61f781019807920c97e","sha256":"358d7afa85146a073a8eac196998feb68f56d889bb126b05f38eca84fca2db9c","sha512":"3a819045f743ff4fae408526cf42ee34e7681f99eb7603292ad3985da9667553775c2ff84ea69893380b9071f4c4e0f8c377386587965d1ee3c4f343591da958","ssdeep":"","tlshash":"26b01209440c0272f24191c5102b251287bb210a1d100a0089ec834c8d0e0092182006","first_seen":"2026-06-01T18:09:18.929363Z","last_seen":"2026-09-13T03:05:55.48538Z","times_seen":32,"resource_available":false,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9tb5r5oy4kig0dbngls.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.244Z","timestamp":1789268707244,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9tb5r5oy4kig0dbngls.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 89188\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:44 GMT\r\nETag: \"85ef41675f84aaf966b0af637271972a\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3229\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89188,"size_decoded":89621,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"85ef41675f84aaf966b0af637271972a","sha1":"9cf0066975c5bf2731acf5a95a8c97b5d6bc364a","sha256":"f72b80d430d82a1201e1de42b9a7da960e29872ccb6d3d21c2383907c6ba3856","sha512":"e75fe8f763cf457a8f050215b3def922b1628a6ae615aabd77858345639a9ea60e72e8232a7519643572cf905ade4972b4a2089646ec01a36d1c8d3c627321cd","ssdeep":"1536:lsDbT0ZHPgdDS/ogywq8nhaJKXViWw/QdqR5PCne4LaMnKGMnYDKzFUuqG09Z6Iy:ObT0dY9+4QVA/tKHTMnbzFPw8Ivq","tlshash":"4193023b656adcc6aebe363722b844a0418370d60f35b90e817ff045edd6d80949aa5f","first_seen":"2026-06-14T20:28:34.075223Z","last_seen":"2026-09-13T03:05:55.605438Z","times_seen":37,"resource_available":false,"data":null}},"time_used":993,"timings":{"blocked":957,"dns":0,"connect":0,"send":0,"wait":29,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/game-99j3hAkJ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.254Z","timestamp":1789268707254,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/game-99j3hAkJ.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/assets/index-CixQeApu.js\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 58\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: \"6a9e5e6a-3a\"\r\nExpires: Sun, 13 Sep 2026 15:05:07 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04h2Q194_44919-40729\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":58,"size_decoded":709,"mime_type":"application/javascript","magic":"ASCII text","md5":"5b8b7569fd7043aa81797b66d0c18353","sha1":"f7bcaa6920de97f0e6660f8655dc672acbf16a54","sha256":"df6874c8321419d3e0a577e002729a901279817d2a22b9cf597f4391ba4ccb11","sha512":"4800563340f6234c6bef8aa7ef56dcdfea507cefa6b791b97a93ecaa599b033fe470d8198867fefcf8aacfbfc1896a40c670093ab8789b874703c7c2944ac636","ssdeep":"","tlshash":"fea00215141184a5016620418522e5c920046b88761671aaa2585e45a0628518446f39","first_seen":"2026-06-14T14:24:21.543491Z","last_seen":"2026-09-13T03:05:55.614278Z","times_seen":43,"resource_available":true,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd0b72xdj4b8t8u6xrbkgkmacr4i.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.825Z","timestamp":1789268708825,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd0b72xdj4b8t8u6xrbkgkmacr4i.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 6192\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Tue, 09 Jun 2026 06:38:52 GMT\r\nETag: \"28d77e3d7493e7697f7cf913271a4bae\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2148\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6192,"size_decoded":6623,"mime_type":"image/png","magic":"PNG image data, 420 x 264, 8-bit/color RGBA, non-interlaced","md5":"28d77e3d7493e7697f7cf913271a4bae","sha1":"22178aaad2dd904de82e8095460b261f955a9a50","sha256":"a5651db847bb7ad90fd680923b1a1f3588b26066226b0c05663476f1b0499ee9","sha512":"42de1e99f4f0d19ae0ff8f99a7232dc30dc72e757c5b1cad96278607daecaa3bb5cdaf33956a178022d4fee692873a495f5271437d7880f982596721cdd1d879","ssdeep":"96:Ak3H9pFDO76NpXYiDShKAIKHKlCAzslj6noK0EEK2CARhkdjhmatxtFrU0:Lo74pX7AIKHkC8BEK2C+kdjcAR","tlshash":"40d18e833d8bd144c59686fc7f599040ecaa834e7d1f4e9c4942d06e8d98dc44b91ea1","first_seen":"2026-06-14T20:28:34.2381Z","last_seen":"2026-09-13T03:05:55.620099Z","times_seen":37,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/sport-CYkldf0t.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.252Z","timestamp":1789268707252,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/sport-CYkldf0t.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/assets/index-CixQeApu.js\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 59\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: \"6a9e5e6a-3b\"\r\nExpires: Sun, 13 Sep 2026 15:05:07 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_23850-31941\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59,"size_decoded":710,"mime_type":"application/javascript","magic":"ASCII text","md5":"39702f3b369f9d1a8d60ac05517caa20","sha1":"e556d3cb37ab5fc22889b168fa58a84ab7b6d6a7","sha256":"6e7b538d5d0d68dd48b6a150c9c28486bbc0b3438a4004f8a3b1112e60218219","sha512":"2d7e7565a3fef8461e8c1480568f19f65b38a6321921e6483162186ce9fee1b80e8beee4727c0f9306c6f7e639b7923b619481d8f6f2dc4b5fe70b6e8756001e","ssdeep":"","tlshash":"99a002011502dca1419c25d58231c68234405658615b615981548a89e8219809506b24","first_seen":"2026-06-14T14:24:21.536566Z","last_seen":"2026-09-13T03:05:55.621081Z","times_seen":43,"resource_available":true,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7hc5kzm33x1u03t4b67.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.308Z","timestamp":1789268707308,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7hc5kzm33x1u03t4b67.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 50443\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"770be521046bf914c5f9a6b7bf36fd53\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6972\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50443,"size_decoded":50875,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"770be521046bf914c5f9a6b7bf36fd53","sha1":"f18654236377b38296ccf3332f987f1f17def246","sha256":"6ddb425234146bdde88fc3ed1604697b286cd9f32e2d7f87d0c3b41bcf3335f9","sha512":"fd64329390ec3d46a1ddddbe10a11d0b47b67a19c5d0c32fdeabfec1ef5d517bc485008fbfc040c16e824bfbe178039c81255bde5df98b04fdee8512c6b55ac7","ssdeep":"1536:5WTqZ+TskA2Fn3Iof0qIodAElhksBtgxmUyg:wo+wkV4tJufWsgxmzg","tlshash":"ba33f1017e829a5b9e5f91db1e4389c0ae100dd3c1e743e5f99362b96f9f62121ad0cf","first_seen":"2025-12-11T02:11:47.111239Z","last_seen":"2026-09-13T03:05:55.623921Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1187,"timings":{"blocked":1156,"dns":0,"connect":0,"send":0,"wait":27,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01h35d659vgv1ft6fo28ztqvmb.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:17.943Z","timestamp":1789268717943,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01h35d659vgv1ft6fo28ztqvmb.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:17 GMT\r\nContent-Type: image/png\r\nContent-Length: 939\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:06 GMT\r\nETag: \"6622f5c92cad522d4476eccc6888b24d\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612ed_PS-CDG-04uki195_56153-3290\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":939,"size_decoded":1370,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced","md5":"6622f5c92cad522d4476eccc6888b24d","sha1":"f373d78068e422bed2ab782820c6301165b9a94c","sha256":"117556b783be15e8d9938b3c54f861e1b572013219f916e0e3bd47a0c98160bc","sha512":"43b3e8352342378dcb6cd6e36c52ca2d33d65fa42a76e4789a29218a39417fca1ea9527827cee1ebb7026391425029369b6dae5f055cc5f73c33539b983c097f","ssdeep":"","tlshash":"c511f7fee2c2e832cd592dfd96723c24141b220fb89053140d87fe2189e881f19b8942","first_seen":"2026-06-22T04:48:29.270657Z","last_seen":"2026-09-13T03:05:55.628189Z","times_seen":18,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkswrgi7dk460qq9fuk.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.258Z","timestamp":1789268707258,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkswrgi7dk460qq9fuk.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 43594\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"188df02eda0467b7ca1374a4d6df55b6\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6964\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43594,"size_decoded":44027,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"188df02eda0467b7ca1374a4d6df55b6","sha1":"d8d37e619cb80da1c4c67c650dacbd02f06d3a03","sha256":"a4628fc9d10fb679cf4763bb2a6fa2e1ea868eb7ffeab0798fc21d8a857b134e","sha512":"b43b9773fb68ba10ea0fd16d939d4fbacdd6e65ea1938d5cd0d75d85871610ad238da32c08ce173c8647cb373e99ce3e72429d1704b2da608f62d13f5dcef8e3","ssdeep":"768:SilUwy24zYgwVhpY/lBjJofF8XiacVo5+fz60eYqvl+ktVVHzE:5lO2KwDY/l/2ve0eYq0SVVg","tlshash":"1e13e03537f66984d981c63912c4a776262bcd3468c6161f8da21f463a0e3f2d9bb4cf","first_seen":"2025-12-11T02:11:47.301517Z","last_seen":"2026-09-13T03:05:55.630435Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1049,"timings":{"blocked":1018,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkwmj22jnv5c0burnvh.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.268Z","timestamp":1789268707268,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkwmj22jnv5c0burnvh.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 40911\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:26 GMT\r\nETag: \"16e42c5e8a9cf3506608c2026d959029\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2139\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40911,"size_decoded":41344,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"16e42c5e8a9cf3506608c2026d959029","sha1":"84cc02fe6f7036ccdc5bcecfe7907ee12d417090","sha256":"4ebc50a575212e1dfc7300511442ac5dc0eb4f92289068592b3f88dd9723ec78","sha512":"aad4fa2829b6ec6beb0c1ac8dc73672c0b96986123c9eb1014d03e09f033082158ab18ce69543e1d331dcf6feebb49b0fc067213387297cc8fc1bcad0c70a096","ssdeep":"768:ZdPEpPHrutCHqP89ZDk2IBJXPH4BC0XSO9A6LdCVZ/FgBHO:XPKLxJkF7PHuC/VvgFO","tlshash":"8503f1487acd4e93c58641314d12a1dfe1c9adeda6eceb49c8090e7fee9044855bf09e","first_seen":"2025-12-11T02:11:47.060131Z","last_seen":"2026-09-13T03:05:55.636814Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1089,"timings":{"blocked":1058,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:09.176Z","timestamp":1789268709176,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 300\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":300,"data":"{\"matchIds\":[4289252,4290962,4290967,4289571,4290966,4285740,4290993,4289566,4289233,4321019,4324768,4324916,4324917,4324918,4328859,4328567,4328212,4328546,4328557,4329191,4333244,4333245,4333285,4333288,4333246,4304266,4304265,4304282,4319816,4318878],\"oddsType\":2,\"languageType\":\"CMN\",\"isPC\":true}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nContent-Length: 98\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: f3a626f4bdd101146cb\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e5_PS-AMS-04DYH56_28018-9810\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92,"size_decoded":597,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"1480708382852bb9a4e4597f1e95f2fd","sha1":"5b2530b98285a4b4cfa4a8078913892ed2a4254b","sha256":"135dce91190697a773f5a0c1bbcf83f3b81f062c8020082cf84a8de558fe3a3c","sha512":"1764384131c0b47683dc1e44a75a0ef3022ca7ed3276b9226752d27d7c150e9dae6cde7bd8dfdb4061a9eb3a26064c1c5525d74bad337c5e7a89cd790fd3af71","ssdeep":"","tlshash":"4cb01205001c0271f241c1c2106b151187bb110a0d10090489dc938c8e0f00a1142006","first_seen":"2026-06-14T20:28:34.315425Z","last_seen":"2026-09-13T03:05:55.640991Z","times_seen":25,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":239,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00012.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.347Z","timestamp":1789268704347,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00012.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 36404\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-8e34\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_44919-40714\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36404,"size_decoded":37049,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"0276b7d50bec56a8943c03e43b5b582a","sha1":"d5dcfcab15eb45cd389ffaf64bfc5f14fceaa0e1","sha256":"5b27d563d2859b3f5e218bc55e96a0b4d06383fbdd56d3b31fb1f5defaa8d814","sha512":"29cd91f248170b054dd460dc2d5222ef56ff47f095ca40d8a46781c8b2b3eeff0a50760db8793c75dbbeb0702867954b692f2c91f58e4d4f01d243b5106bb857","ssdeep":"768:endXFh4G5tdVSHOjhrB7G1H9GVjEgVoli43IPP9FJFDm1CzlQKJG:0Hh4GDDSiBuGEjli43IPl76Wl5o","tlshash":"4df2e01a5ecf49afe2623ab055f458f58c144277396752806f20320758f89c8f6fea67","first_seen":"2025-03-14T20:40:58.440769Z","last_seen":"2026-09-13T03:05:55.651904Z","times_seen":116,"resource_available":false,"data":null}},"time_used":1324,"timings":{"blocked":1137,"dns":0,"connect":0,"send":0,"wait":181,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00033.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.390Z","timestamp":1789268704390,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00033.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 16628\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-40f4\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_24105-30072\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16628,"size_decoded":17273,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"499606eb05a74103b28c69551de88f77","sha1":"15f9051cb6d1f303110c08d3654b36d4de262b5c","sha256":"f993c654b0121829cdf4fc8897c30ff2f25bf3c9bda1cdb92338918c903d579f","sha512":"52000baeb20b0484de58480176df4be5269424423e702610e5a03155f9b1d0dff96857977b52d563bd89d40b4a0884a07ebaa138e82f60d52b93bcfdbd961552","ssdeep":"192:wIUjIL0km+gJERyt6ztukQ9beugrmb/2qVllRPGbp8+gVaOXCZizeMYBZpAvPUcq:wljIlwt6BT2Gmb/blRO9HgVvz3Ow0u8","tlshash":"2372c01233344e95de06cef64a3daeecfb181749becc8864605033a586b79e40b9bd74","first_seen":"2025-03-14T20:40:58.424957Z","last_seen":"2026-09-13T03:05:55.653192Z","times_seen":113,"resource_available":false,"data":null}},"time_used":2584,"timings":{"blocked":2403,"dns":0,"connect":0,"send":0,"wait":178,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/msg/indexNotice","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.817Z","timestamp":1789268705817,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"GET /uapi/msg/indexNotice HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268705\r\nx-cq-sign: 32a3bac94036bab58fa7e384bad2e254b12a638faaa4baceeee5453e7021da7380ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: dbc88b9968c2d41868c63c29983d91eb\r\nX-Backend-Time: -\r\nX-Cache-Status: MISS\r\nx-via: 1.1 PS-CDG-04koU196:33 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50987-6407\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44,"size_decoded":762,"mime_type":"application/json","magic":"JSON text data","md5":"e5eccc32caf200b40dd801345f284f89","sha1":"11c2f377757afb34eb3fb02730058d9e8539e8e5","sha256":"b1e372ce172363937db74a6345502d323a6eb9983f2756e89ddda589de119e0d","sha512":"5a45f611ae4e9149fe49a57fc574ec2d528fad6b9c257da7b3d7adacdb485a9dfd4f039272beac5be7956e6260fc8997eadbaec5efd7a9d89f1d6af3ca950996","ssdeep":"","tlshash":"0f90040c35541f343703c0c7704d104443f510445d541135cc5d5d1d47554141701530","first_seen":"2026-06-14T20:28:34.214721Z","last_seen":"2026-09-13T03:05:55.65425Z","times_seen":23,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/channel/g9kdwd056cidior6jr6h7ubq9wk95hf1.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.170Z","timestamp":1789268707170,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/channel/g9kdwd056cidior6jr6h7ubq9wk95hf1.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 280299\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Thu, 21 May 2026 23:45:53 GMT\r\nETag: \"8276b990a1a7ad81010162abaa701d7c\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04koU196_48246-7770\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":280299,"size_decoded":280734,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 2400x500, components 3","md5":"8276b990a1a7ad81010162abaa701d7c","sha1":"cc34b2f91bd27b0c0a494918bd179c5cb29be98f","sha256":"9ebc62a6fed19d22fddc635cb3a4825415952f71fe4061473d7d0d441c827be1","sha512":"ee863020b573ef446ba34c53133a3ac8d44ec1df6c2375cb00d921f7eeed0fc6d1f3d00771f558fa2425508d0e576d2f443767861567ede59e32754d22d0c0b9","ssdeep":"6144:C0TF6XKRx90otmoF4tJ50/1RYJytkWOOIgmw7LUxp884lVx:C0Tpx90o0oFE0vYJy+XVw7LUP8px","tlshash":"4c5401045723ac9ec10a1b7641cabd5da957d6357b2e0ff8c007ef8deaa23b1d11a25c","first_seen":"2026-06-14T20:28:34.319449Z","last_seen":"2026-09-13T03:05:55.655271Z","times_seen":37,"resource_available":false,"data":null}},"time_used":926,"timings":{"blocked":-1,"dns":745,"connect":27,"send":0,"wait":28,"receive":92,"ssl":31},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdee1yckbylkx3lhpdal8l.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.331Z","timestamp":1789268707331,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdee1yckbylkx3lhpdal8l.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 78004\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:54 GMT\r\nETag: \"238b0424f2128e6ad28aec2797d9d45b\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6975\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":78004,"size_decoded":78436,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"238b0424f2128e6ad28aec2797d9d45b","sha1":"4f7e8c013b598fa5159c2b4cc1baef3905b2aa71","sha256":"ef9a2147c8d6ffd3e61d76e91f7bed58e05739058a3b1587c0e9a4d88cd04c3c","sha512":"ec60f39e02cc00ffda655586137be27e4e0e3a71bde4e55f58611be51727fe4dde2e7720cd25a01b8027d348242ec9a8eae47f97aeb218171ecf8dc8289a5220","ssdeep":"1536:lvOqsK7Wn21sQMmTQurbBnJiKucLvBZUrh8Ap+oFy/JhqAd8puVomh4ezu:lvXi+v0iSKvLvBqh8boFkJhqAcsos48u","tlshash":"917312a45095a0ff81e6d1bb79c92cda482ae40e1778b68ad5c0f1cfe86da0404ff5f5","first_seen":"2025-12-11T02:11:47.150214Z","last_seen":"2026-09-13T03:05:55.656383Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1280,"timings":{"blocked":1247,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlj73nq5k07u043wm0a.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.320Z","timestamp":1789268707320,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlj73nq5k07u043wm0a.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 84425\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"f0d4d56948adcb619fac88847cac04a5\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2144\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":84425,"size_decoded":84857,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"f0d4d56948adcb619fac88847cac04a5","sha1":"5f705387806328994ac7099ad898a3ba97848bf9","sha256":"d4bf0233d81b007792b5c7615bb6c9727fe6a5507eb74ae0392e8499e8106795","sha512":"688253f47f82202a106f3e2c3b7975c324045d95569dd8e4e20fc52d67ed6178dfb72407ebada7daf1c9f349ff926943ece0a29497d8ead9a15e4de2d5816a7e","ssdeep":"1536:ZZlpBbLxkbJurA/E1qy+VrPSpWGVyOjpZQxPCPUCMzmNxQwZhi:ZZ7/kyA8HQrpGVjeKUCQmNxdbi","tlshash":"8d83126cc3502ca7da117bb2dee42a9b5cd8a9c222c5d2510de7acdfb2c05550bee538","first_seen":"2025-12-11T02:11:47.311061Z","last_seen":"2026-09-13T03:05:55.657324Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1228,"timings":{"blocked":1195,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedljmjo5qzn7x0z0gynu.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.319Z","timestamp":1789268707319,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedljmjo5qzn7x0z0gynu.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 75739\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"b2c1af6586297185d91144211cc6ec7f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30821\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":75739,"size_decoded":76172,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"b2c1af6586297185d91144211cc6ec7f","sha1":"7c48fc2e417ae5f7fda128a33ce96b473eb06036","sha256":"e369f4df7b1816692feec1c664e6546d8fdaa06a3b3a8bf83386c85f72ea5632","sha512":"ebd3e0497713cf994871f0a8341812b8676991107f4927c1573c27992720942442374c828e254134a73961824dae785f2bad4686ee075611598b3f700a9ec5da","ssdeep":"1536:YJFRYPImTAzVY8EY+LSLSIjWmWvOtBlFbhxjsV2mci7j0kHEritsgI:cY3Kn++LSTNvS/CcinfHqgI","tlshash":"c7730208ee374e546c36d0880c85ca0e495c6939a21f5c31bd06e8dbce6568c8effe8d","first_seen":"2025-12-11T02:11:47.188917Z","last_seen":"2026-09-13T03:05:55.658185Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1229,"timings":{"blocked":1195,"dns":0,"connect":0,"send":0,"wait":27,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/game_more.svg?t=1","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.887Z","timestamp":1789268708887,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/game_more.svg?t=1 HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/assets/style-BAEGjb_c.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-cde\"\r\nExpires: Tue, 13 Oct 2026 03:05:09 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04VRO197_23850-31949\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3294,"size_decoded":1559,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a8f73cd3151f33bb2b9df09a896b7b22","sha1":"dafdfa7c207ab6b69c5540d6ba788779e65c3596","sha256":"bcc49a96c3e01d542e88e47c1cbed5263caab97a80d6b4558566c37e39a931fb","sha512":"aa0b253494dfc123846888176ff17427c1cf5ca0dc48ff270ff3cf605fb7f8220d399f10e748e30e6798506539494e3ddc57d9f753b666b8121acf799d65de33","ssdeep":"","tlshash":"9e6123b66bfca95ee10a4180d6d1f9540908f6d7c35dc2e0f14cb8886b704da1e3e78e","first_seen":"2026-06-14T20:28:34.128327Z","last_seen":"2026-09-13T03:05:55.659155Z","times_seen":37,"resource_available":false,"data":null}},"time_used":336,"timings":{"blocked":149,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/mapValue?gameId=1\u0026key=oddsType\u0026value=Hongkong","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.816Z","timestamp":1789268705816,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/mapValue?gameId=1\u0026key=oddsType\u0026value=Hongkong HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 6760389c68c2d4185ca7b35cc5d991f6\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_25562-30848\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":791,"timings":{"blocked":604,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9ta9hga02oia03n89k7.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.241Z","timestamp":1789268707241,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9ta9hga02oia03n89k7.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 75782\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:45 GMT\r\nETag: \"c459861a45f51aa844201464a47e98f7\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33022\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":75782,"size_decoded":76215,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"c459861a45f51aa844201464a47e98f7","sha1":"3ed903fc1b4324100f1ed453b5284be85cee9ccc","sha256":"812b5104dea279050887dceab521b229728cafaa08f85e1c6bcf5d6d563d19c8","sha512":"492812aaf9aea7545650dca5ecaf2aa446b1eb87da99d3f3b72c77516890946936f1109174b3952da0801881c940787003a276a0dd9421bd6be57af40800f61f","ssdeep":"1536:64iJLiLkIjhTGekhrRUN08h6IquNzjwyvceUbe7ATPsr2qcxz:lwi4IjhTz2rVg69uNzkyvceAe7e7qEz","tlshash":"1a7302044460d3a6ec311efe94a00d183ff9ff85520de9f62d29fb7eb1e6a891574a10","first_seen":"2026-06-14T20:28:34.248917Z","last_seen":"2026-09-13T03:05:55.660153Z","times_seen":37,"resource_available":false,"data":null}},"time_used":998,"timings":{"blocked":963,"dns":0,"connect":0,"send":0,"wait":29,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/logo_game_placeholder.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.091Z","timestamp":1789268707091,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/logo_game_placeholder.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-c6e\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04koU196_50640-6037\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3182,"size_decoded":2287,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"54afcc2f550368ff854d74a0b30174e9","sha1":"16e1e7657e85a8e2d275e07454636b9b8c5f2b56","sha256":"4469e45d5f2682b8e4e8c160cef6ecc3f3384f32e32ad886e1090b0729121fc5","sha512":"59940370bf889a0a094bb70c9bdf1c35f24b322592dbb0b623ce8a7cf4e1caf006c12c909625a001a65f99e7e243b096d378a07532ff2b74478be5c03c062ba7","ssdeep":"","tlshash":"8461c484b3f5a264f408e3fddb228031394b24fa26c2c994c6d6ee9bb42108d4e1ccd7","first_seen":"2026-06-14T20:28:34.234504Z","last_seen":"2026-09-13T03:05:55.661162Z","times_seen":37,"resource_available":false,"data":null}},"time_used":237,"timings":{"blocked":59,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7hb2p4ohfa180xak6yy.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.312Z","timestamp":1789268707312,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7hb2p4ohfa180xak6yy.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 54325\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"44ba435289a494ad43e9dd75aea8eea6\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2143\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54325,"size_decoded":54757,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"44ba435289a494ad43e9dd75aea8eea6","sha1":"d0f38f36c12e35a777e88d795e91acc1420e2e29","sha256":"bc70bc3814000e0c003bf377f5d2228ca880e56522d3fd706b12cffa8f9344e3","sha512":"ac276fc486b26d2211258f524f2519d4d20b10bdbd673a0b0bd72a0d1daac1823c4dc91ee4b597d2fe048adb1c68938f87eeae4af4e9e08e51deebc7de29a2c4","ssdeep":"1536:+ZxTIAGk+8QOuh8zeaUR6M/4HVWn1YXIXaP:YI38Qn7aU8hWm5P","tlshash":"d43302e4f6448c6ff3508e7241f9492a9798ebabf24f1ba06ea00353f9056d2b1507d9","first_seen":"2025-12-11T02:11:47.286224Z","last_seen":"2026-09-13T03:05:55.662153Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1196,"timings":{"blocked":1165,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlk8k0ne3o8m0tuqtwk.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.332Z","timestamp":1789268707332,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlk8k0ne3o8m0tuqtwk.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 76299\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"218e6a621b82f1f856bfe997bfe64842\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7791\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":76299,"size_decoded":76732,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"218e6a621b82f1f856bfe997bfe64842","sha1":"e7d1b32a950cce011e5fb1dc1f38ab047d8d280d","sha256":"0362b25bf9c9d922dce693e8dfe150436b98152b73157571516acefe86c295d0","sha512":"a722614668fe45a69a599a8dbcdc765dd8a5cabdee0a2f49aa787c94c46e163b727fcb752635bea41cc648fa96016e55e46f8f9083c624712d463157d4c0a622","ssdeep":"1536:isV7E7WPQD02BEdMquE9wQRztYkcZixVPEgbSTld:m7uQDidMqPFRztYJZmR56X","tlshash":"627312ee7af7049e06ae036a412c532cbbd60602253c670ddde4a1f977951e6300a7fb","first_seen":"2026-09-06T17:58:09.654063Z","last_seen":"2026-09-13T03:05:55.663117Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1236,"timings":{"blocked":1203,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7hdrc64y8su0lu2ax2.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.184Z","timestamp":1789268707184,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7hdrc64y8su0lu2ax2.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 128967\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:12:37 GMT\r\nETag: \"7b0d4c0eb3c2377b784b8e75d8f2405f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7771\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":128967,"size_decoded":129401,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"7b0d4c0eb3c2377b784b8e75d8f2405f","sha1":"77bfe5802efc61344f38adf8b040066d88fb0c7f","sha256":"29a555d5d50b7c21d8c1458b3dde4f22956fa2e77d05f6f686475faa2dd59c2f","sha512":"defd9a0f70bf02d5140666345c51d2de714e0154952e8fa0024aedcfc4d870e47f3ff7bf1c516c3f407e461c2b7bcaea6e7ca896097d3579c0fefdec4883eb26","ssdeep":"3072:A7bI4pf6+i59gbX030aSBeFAcJVXX9Ix6RcAPHTED5n3YGxwVzeh4k0vN:A7bzXWg7YqEAsVnqYR+RxwVzeh0V","tlshash":"59c3124b0c8b0815ee5807e0951cafa272a39dca87d7b48ec6c1db9450eb1e59f71f92","first_seen":"2026-06-14T20:28:34.101555Z","last_seen":"2026-09-13T03:05:55.664039Z","times_seen":37,"resource_available":false,"data":null}},"time_used":929,"timings":{"blocked":874,"dns":0,"connect":0,"send":0,"wait":30,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/champion.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.774Z","timestamp":1789268705774,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/champion.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-709\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23238-37991\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1801,"size_decoded":1536,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1364b0a584afd5c683688caa8d463c8e","sha1":"fcb644e1a97e5005f315c19b217f6b262ddac733","sha256":"47d66c74502c7ebb8ed77e718ccb481972017f2267fe2ecaabe400354d24bff5","sha512":"98b76fe5c4447a495eece1e963db376918da2b9bb3602b353dd9a16e47cd13a497cc5c298b50245cc6618c9249a0401e681feae6ff62f6750190564bdbee9ec0","ssdeep":"","tlshash":"1a3167f661a84a988949471597e8f694a17df1a7f17980c8f7053191ec148e73b39908","first_seen":"2025-08-30T23:50:55.444531Z","last_seen":"2026-09-13T03:05:55.665084Z","times_seen":111,"resource_available":false,"data":null}},"time_used":655,"timings":{"blocked":479,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/menu_vip.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.777Z","timestamp":1789268705777,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/menu_vip.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-4fb\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_46621-35455\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1275,"size_decoded":1276,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6a27e9f8955d61454946eec68463acbe","sha1":"91757820ed2c30ecb5dbeaac551ba93833670872","sha256":"d398f6fdfa2c3e81a41be1599fc897b6bb30ef80b475e7a717b13b1d46396090","sha512":"808e0028c4c7080de055595fa722e8182dc74421448a2e9d775dfd15d62a6b024b9b3d2f9380dd15c4a58dbfbe099bfe23b1f4fcd725469a97e399388553c243","ssdeep":"","tlshash":"cc21edf522fc854c9505c740e3f5f65c193af1d6a3152089b38135519e100fbba3f56c","first_seen":"2025-08-30T23:50:55.676492Z","last_seen":"2026-09-13T03:05:55.666586Z","times_seen":111,"resource_available":false,"data":null}},"time_used":817,"timings":{"blocked":639,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx024f3dbx0fov2ien681oj3h1m8.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.854Z","timestamp":1789268708854,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx024f3dbx0fov2ien681oj3h1m8.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 8108\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:11 GMT\r\nETag: \"835e8926d66be2e4b083298b9b8cf94c\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04VRO197_22838-33040\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8108,"size_decoded":8540,"mime_type":"image/png","magic":"PNG image data, 200 x 100, 8-bit/color RGBA, non-interlaced","md5":"835e8926d66be2e4b083298b9b8cf94c","sha1":"1b1f0233923c21df74ed94d58ef2863ac30e4f8c","sha256":"6f52485f547538daa825f005c688f4a6fd59d270c9f23e51694db4023c7a0257","sha512":"2b94cf704965aa6fc39135da78e2992c0f19f56955bce433eae2f67b52a5fe141638985de6ae47131a2641d9bf480ba19632ebb233bf59e93bdb3006ed4d4b42","ssdeep":"192:JeUIwDY1H8EJ+ppTdP0OBr+HyXrCRJfzpM:gUZDM8E2DPtFZ0M","tlshash":"cff1ae90f1849c31c428e149a773e009ec2ee0d8c1626db9b73e5faae366311d855883","first_seen":"2026-06-14T14:24:21.217385Z","last_seen":"2026-09-13T03:05:55.667775Z","times_seen":43,"resource_available":false,"data":null}},"time_used":171,"timings":{"blocked":143,"dns":0,"connect":0,"send":0,"wait":27,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlq11b2qszc107lo0p1.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.322Z","timestamp":1789268707322,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlq11b2qszc107lo0p1.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 63553\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:54 GMT\r\nETag: \"9a259be0817a103a789c953fbdcc64b5\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3239\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63553,"size_decoded":63986,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"9a259be0817a103a789c953fbdcc64b5","sha1":"9bee4a6ca6bd1d3c9579fdc19dbc94e424efd632","sha256":"86f292879ed4c293ea1c5d42c7a7266556ab4b2f2b8b26364600626141fdd975","sha512":"7a01c8ddf45de1c87a6f549ab37a24c21f716489bd7879a342f2229e6c3c2599200e88eeff9ff1729b9e2f8b123b694f6dddd28194273b5ba95a9c393acc0e23","ssdeep":"1536:GafIP0lDSx8u/sZlk4wkJV4nUa544HANE2bYlg65WZZOJreXoN:GbGuXKC4dV+VKE2Jk+XoN","tlshash":"7c5312816bdb0852f89b58d3090be1353512ffe628ef926dac6ffd800e55d28b75604d","first_seen":"2025-12-11T02:11:47.24888Z","last_seen":"2026-09-13T03:05:55.668886Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1250,"timings":{"blocked":1216,"dns":0,"connect":0,"send":0,"wait":29,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-DE4r0nPP.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.456Z","timestamp":1789268707456,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-DE4r0nPP.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-11cb\"\r\nExpires: Sun, 13 Sep 2026 15:05:07 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04koU196_50640-6042\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4555,"size_decoded":2593,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (4554)","md5":"5568fd2eaa670f97b4754e8a1fdd6436","sha1":"f4a9bab03b3d3c611059e338903bee660b978bbc","sha256":"904eeecb84ef95667657bb79e748a939c5212af9bea5c36557427d83897392a0","sha512":"f7ef28cdb0d07e85be9ab0e9a91b21aec230b0f1b25d09539c48b4881466c2a6b2451c0302bf85064e9f48fa6fdb859e7f727ac15eb94d854cd0c51b41a2b21e","ssdeep":"96:5oTgIrfj+EH3HATGtexAyDIFtBIHIDQVkwAV5tArPda7NHt7aLtOve:5mgIXP9kHDub61VkwAVvOIxHZYAve","tlshash":"e191b9957598747f947b00da609f8451138423d9e23480d1f3ba7f29379e9e02edab27","first_seen":"2026-09-11T22:02:29.490408Z","last_seen":"2026-09-13T03:05:55.670132Z","times_seen":4,"resource_available":true,"data":null}},"time_used":348,"timings":{"blocked":170,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/live.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.772Z","timestamp":1789268705772,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/live.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 575\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-23f\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_46621-35454\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":575,"size_decoded":1221,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"34dd05b0f0717c2c77e178228a1e3c52","sha1":"25a80d811a973b68d14dd7ebf5b4e2694c5c5824","sha256":"23df26b1d392019ba82cbeb5694bbb6f14a458e06101b2bfeb781f90856c98c6","sha512":"4a03e8a64166a1ecdc4ef42b500cf09929a53e86d04102bd893db790b31bdb4aa6956cde0a32ef34ef5074f832190c66ca5538aeee98701e20520d95f3a6ba54","ssdeep":"","tlshash":"e3f04693631c4d5de20906c0f3ace5642019b1d5c7197482b3023571aa104fa383badf","first_seen":"2025-08-30T23:50:56.006671Z","last_seen":"2026-09-13T03:05:55.671173Z","times_seen":111,"resource_available":false,"data":null}},"time_used":639,"timings":{"blocked":461,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameSubList?categoryId=5\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.358Z","timestamp":1789268707358,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/gameSubList?categoryId=5\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 91696a1669c2d418f0c63c295d3bb45a\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:35 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_2046-65494\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1235,"timings":{"blocked":1046,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1w8mde1gt7fmiadr26h2znq00.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.816Z","timestamp":1789268708816,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1w8mde1gt7fmiadr26h2znq00.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 5107\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:27 GMT\r\nETag: \"5c5848ce055e2e2b561649b1f0b36a82\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6977\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5107,"size_decoded":5538,"mime_type":"image/png","magic":"PNG image data, 200 x 100, 8-bit/color RGBA, non-interlaced","md5":"5c5848ce055e2e2b561649b1f0b36a82","sha1":"4707e120e9e70b90a465a7b534f88f73b7e3717f","sha256":"1e9c491207d4355c8b9074ca74e2fc3e269732a75da82f644b717bc1fb8f5eec","sha512":"b2754278b57744dbbe917540ab6afe879fdfed68d02513df67a9f8781d3bdce38a37c73ecac592ec6eaea22a7b5ae4efc4804683b447242833bd743cf8880b85","ssdeep":"96:uVjWH9+nsNG9TGnzH/yvNqYNN1YjkpxeOU18NE89BZkcNRRW/UiUe:utWHMnJSjyvbyjgjUQBZZed","tlshash":"20b18e1b025d016ec59c6f01d8cd2e240db33e61de5276daf464e8b308810d07430f9b","first_seen":"2026-06-14T14:24:21.27841Z","last_seen":"2026-09-13T03:05:55.67221Z","times_seen":43,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00031.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.387Z","timestamp":1789268704387,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00031.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 34605\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-872d\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23238-37994\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34605,"size_decoded":35249,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"42886509c6cd99dd8c0423c53d923339","sha1":"1ac5899fe50f19b298c3e8aa740776ab6b0ab162","sha256":"f6c0a5cda33632ff5a0a28fb278ff49653480221aa90ddb4a4d65bea940ba0ad","sha512":"acdd35c5fe489eb327f398d2dda29eb3c77e55d797d5aeec38b0c3b815bfcdb016b0c1abb15dfa469b4c357ea4ac3dea383de84a1366f8ffc51a8b052e06daa6","ssdeep":"768:BpTB3oyk0QzDPInbAV1+ySKHwoHpUtbvv7AbqQsGhj17khM:BpJoBRTrV1DQoJG3AF","tlshash":"29f2f1851041b417e90b98bbf2a4b6907f4a6fe0a481cdf31724dc51a7f3e2b2745b2d","first_seen":"2025-03-14T20:40:58.501374Z","last_seen":"2026-09-13T03:05:55.673204Z","times_seen":113,"resource_available":false,"data":null}},"time_used":2553,"timings":{"blocked":2375,"dns":0,"connect":0,"send":0,"wait":176,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7hbjo9nqpn1b0sum6ep.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.300Z","timestamp":1789268707300,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7hbjo9nqpn1b0sum6ep.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 59447\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"49e4103224ae3cb6a50ca5894c909f90\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6970\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59447,"size_decoded":59879,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"49e4103224ae3cb6a50ca5894c909f90","sha1":"7e5885af5d4dfe77a9c19f900d50bc85796a69b0","sha256":"42ab21864b2520a88589beb32f83662ece93ed11e7fb9f9ccdd8610c97830787","sha512":"39514a43cd41b948c0ee8b425f7564f1194917cd58dd7e5b3ce62a688a08ebc19deb92133433c47c7aef5446d0991351ee31a922a452376c4a4f7a57bb9ed027","ssdeep":"1536:NI8Suof7No3N6MlDKo7sZTTmmB1BJhE8bdZhq53lEFDTnl:NItf7No3llDKlxx1Bf5Zh21kTl","tlshash":"d243f1fc1772a3d022f60fcd4cb5255d9bab029624abb5aca5ff5c20075ccf81566a0b","first_seen":"2025-12-11T02:11:47.373008Z","last_seen":"2026-09-13T03:05:55.674832Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1157,"timings":{"blocked":1125,"dns":0,"connect":0,"send":0,"wait":28,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7h8uoes9x5u00g8ldeg.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.860Z","timestamp":1789268708860,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7h8uoes9x5u00g8ldeg.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 6870\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"33f8d4adbe1965f433aa0b383b61aec0\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04koU196_38874-6984\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6870,"size_decoded":7301,"mime_type":"image/png","magic":"PNG image data, 200 x 100, 8-bit/color RGBA, non-interlaced","md5":"33f8d4adbe1965f433aa0b383b61aec0","sha1":"ae67060b92537cbb690ae43ff9a5cee317c5ad96","sha256":"eb1b3504e7d741a2c763f91948f01b72f5968e0dfa538f1fa594dec58068fbd7","sha512":"f5b18dc6e16516e21810cfcb1f094f99d4e836a902cde76a536e43a7ee9fba5938abfa6ededa2fb1bdad6db576c9d9c5df6c1e78a40c8c0e75c730757334107e","ssdeep":"192:Yor5VwyYP7EaoZi3MpvrLDHnjac3/+zZU:hVBYPHhMtrLDHjac2z2","tlshash":"e9e19d7aea70e900050872aef2b81b70fb4c0fe234781a80ac66477e7910ca03e71e17","first_seen":"2026-06-14T14:24:21.245279Z","last_seen":"2026-09-13T03:05:55.676301Z","times_seen":43,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":169,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00029.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.385Z","timestamp":1789268704385,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00029.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 39146\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-98ea\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_46621-35457\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39146,"size_decoded":39791,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"395d44d47aa27e9fa0386220f02d5806","sha1":"b2199055a03cfe10babb71eaa9bcbc6b1dae9503","sha256":"c1b13fa36ea56d84b211f6d8292a7cab5e10107740cb02755d3863c4ea98de3b","sha512":"b70d11b7a101c062b874a5743158193d269f3579449dfe86e6fe1ac0536ee4399a9b3acc18a19168ef610bd2583da96910bc7bd6d2508d6965ed45e1e8e1b529","ssdeep":"768:z3NHsTdsOL+D1//tnEXqQ31AXbgmKmP5o1ZEGRK4gNxEkNCyF:zV+VLO/V1YqNpKEqANmCF","tlshash":"b203f1a36c403507eb14313a3eb008bba389f1792365d75ec90b28ddec21aca12f6715","first_seen":"2025-03-14T20:40:58.554352Z","last_seen":"2026-09-13T03:05:55.677508Z","times_seen":113,"resource_available":false,"data":null}},"time_used":2547,"timings":{"blocked":2364,"dns":0,"connect":0,"send":0,"wait":177,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7ii6pom4e15gu8e6bc.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.199Z","timestamp":1789268707199,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7ii6pom4e15gu8e6bc.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 108444\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:14:03 GMT\r\nETag: \"17c5c69671e62105dc5a3aefdbd06749\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33017\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":108444,"size_decoded":108878,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"17c5c69671e62105dc5a3aefdbd06749","sha1":"593e9d00542c36ea6fb891ce9b546bb2832da432","sha256":"f5cf5cbbb4b9770803c2e9fc013d7cb5c550d1433f23501c15cb851935829ecc","sha512":"a649e70072d32d1d958710615e1e9f42625eae1a5f8f6c5c1349df6b6c4db2c7cb157c5433ca7f0754e75093c27df0dd87af5d3984f39b5c1cc2055473f4371e","ssdeep":"3072:P8lF5xyxHD59iqkNlRhW7ua6JRHof8bkZICaLP:0lFqND58qoza6/0UkZAP","tlshash":"95b312de53789c8dc9a351910b9b249d732bbc93b8f688563b1c6b879123b564f03b0c","first_seen":"2026-06-14T20:28:34.223867Z","last_seen":"2026-09-13T03:05:55.678745Z","times_seen":37,"resource_available":false,"data":null}},"time_used":945,"timings":{"blocked":910,"dns":0,"connect":0,"send":0,"wait":27,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqlojuvl2pxp6q3lmsc.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.822Z","timestamp":1789268708822,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqlojuvl2pxp6q3lmsc.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 4644\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"0ca4ba00129d0ac96aa145bc90f8a179\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33036\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4644,"size_decoded":5076,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"0ca4ba00129d0ac96aa145bc90f8a179","sha1":"82071f0450f3e744840ded80b9355fdf1daf2954","sha256":"0c906a147779d67ce188aecfe0eca3a778d07a4610812af5204665cda10eb160","sha512":"a9590f473353a58e8a61155cc1dcc6d9328253c6906243b15e18f11bba6155d671e1c626b82b4103a6ac573bdf804d46aa1e2dd937a545e4ab21f59465541fa5","ssdeep":"96:aL/BjraAnQFp1vjH2KLusGNpIYHQeC5LkoCkOSBBCIzTLwkT/PxUOM:a7BXr8pVjDLh8rwvVxBBvc4FM","tlshash":"d6a15d0c0b695a18efaee33bc16855ee88a03c427b8a98fe57014167d72bdb511bd703","first_seen":"2026-06-14T14:24:21.290137Z","last_seen":"2026-09-13T03:05:55.681074Z","times_seen":43,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00030.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.386Z","timestamp":1789268704386,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00030.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 36685\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-8f4d\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50640-6033\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36685,"size_decoded":37329,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"f831e6b6f89057bb911bcfe68274ce31","sha1":"59a7a9940e4369505b1e451391e0e7c098e0c96b","sha256":"253d44b351c9f153a80bca141ef85c4fc883ca0f1f7626e3206b79351265d87c","sha512":"ac81d405971a8b263fd63a66810d7617ad7e5a778948a2b95736de4db681a78e5a49bf083513a5b73e4b1952cd663c3268d8aa67832ae9caba6dc3ac3270a7ce","ssdeep":"768:qYu8KCrk1umImTFmPdlSi561e4IXdk1s0JxPGnXeZ2:ZrjWTImTCAKdk1s0JNGf","tlshash":"7df2e09c99092b8fe636ddb394605a8310af8b2dd574b9003ad287f473042722fde639","first_seen":"2025-03-14T20:40:58.480321Z","last_seen":"2026-09-13T03:05:55.682191Z","times_seen":113,"resource_available":false,"data":null}},"time_used":2556,"timings":{"blocked":2372,"dns":0,"connect":0,"send":0,"wait":178,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/agent/supportActivity/generalEntry","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.795Z","timestamp":1789268705795,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"POST /uapi/agent/supportActivity/generalEntry HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268705\r\nx-cq-sign: d9bab95b694c8c6c103aac8751bc1db669ff1feed8b297ab9d099fc137d694f280ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: b781b28168c2d4182ca7b35cccf263e4\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_56153-3213\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":156,"size_decoded":852,"mime_type":"application/json","magic":"JSON text data","md5":"1f892c9b58b03c5f0b7b9b3469ee7abf","sha1":"8e41bebb84098236cb126f8ced1582691110c3a7","sha256":"78a9b1fbc4533b23ac060cd556a877fe7e01fce59e6f2fb6c6da2e2f6819376f","sha512":"5e57d7e36a87fc6ab8cdd47c1e7cac2760bf5391cd0471203686a8128ef8c318a391702a22cbf0c4c175dfe463d72449a18b74ebe7970fe7a4980f41a2cac501","ssdeep":"","tlshash":"8ec09bd0f831ee79b7517215ed861d4b5b7c70f2c855c448f87d4f48539c61a4531217","first_seen":"2026-08-07T21:06:08.015742Z","last_seen":"2026-09-13T03:05:55.683065Z","times_seen":35,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9tdzw8pkjhj80uyyt3a.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.247Z","timestamp":1789268707247,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9tdzw8pkjhj80uyyt3a.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 101744\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:45 GMT\r\nETag: \"268e1a24f610fa06cedb5c063ac570e8\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6963\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":101744,"size_decoded":102177,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"268e1a24f610fa06cedb5c063ac570e8","sha1":"6097d2e446db77d0d1a1ce2d6bfc9c053a85ddfa","sha256":"9aa5b2f8cf2cde3129ee48eba64fc9588eef230bebfb994b89bc78a78fbf37af","sha512":"17c424799ca17221c1c4193def656f99a73ad6901d127bb4d3da16c41ade9c8ee63c6ad8491a6d840424e0b1f7927e7ac0626ebcc035de03527223aacf37437d","ssdeep":"3072:IPatjdEIWvWa30ZTCYkHvr21yUIXE4XSZpqTKY4:IP2JEj30ZTBmsyUIXdSZJY4","tlshash":"8fa3128053f69518fb632915a93b93b4d438a9d5a29dc1d8c03e742bd8e708f21a39ed","first_seen":"2026-06-14T20:28:34.144049Z","last_seen":"2026-09-13T03:05:55.684246Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1023,"timings":{"blocked":987,"dns":0,"connect":0,"send":0,"wait":28,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameSubList?categoryId=2\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.273Z","timestamp":1789268707273,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"GET /uapi/game/gameSubList?categoryId=2\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268707\r\nx-cq-sign: 5b9d1aa44ee533b6a231c033ca8b82eeead5673fc011407a17c4c0d33c1b849080ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nCache-Control: public, max-age=5, s-maxage=5, stale-while-revalidate=5\r\nCdn-Cache-Control: public, s-maxage=5, stale-while-revalidate=5\r\nTrace-Id: 2b33231f69c2d418fdc63c298ba25209\r\nX-Cache-Key: /uapi/game/gameSubList:1ff52f15db4565fdc9094e964e82bdf0e9b061a3\r\nX-Backend-Time: -\r\nX-Cache-Status: MISS\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3241\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5525,"size_decoded":6458,"mime_type":"application/json","magic":"JSON text data","md5":"a3d0dcbddbd116a33e4921189546d1b8","sha1":"e4d9c9c8edf3b152032d6bdbe30f4ed2a3428f6e","sha256":"11ae1a62e133cb46d0bb4cf7c0bb0debd3ae81b213f9ad4c7b1057503fcd1080","sha512":"576d93cd7fe46724b36003152132d06d45bb71c4e311f7b2aedf6bc0d6db0f9cd9cb82261dc48041b3aca17d55da5a6cc40298c252ecf3f31103d251187c8edc","ssdeep":"96:kUXLWjL7WLYvfILpLLXSWwLTW4LVILSFmLTogL0bL9WRLGVLyBLTGVLApLYS/SLk:1XLWjL7WLgfILpLLiWwLTW4LVILSFmLb","tlshash":"7eb18d6f195824be5a1787ee2dbbb6cf51c5206b6ddeee41c22cce0194e31e1a373412","first_seen":"2026-09-13T03:05:55.684924Z","last_seen":"2026-09-13T03:05:55.684924Z","times_seen":1,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":184,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/favicon.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:09.440Z","timestamp":1789268709440,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 6319\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-18af\"\r\nExpires: Tue, 13 Oct 2026 03:05:09 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04VRO197_23850-31951\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6319,"size_decoded":6963,"mime_type":"image/png","magic":"PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced","md5":"5e879daf09a45e507623ddaa806009b9","sha1":"1c06ce78042448c220ee80419b327a6ce43a4f04","sha256":"1b11eab3c81575ae16632d942de8c5b804132c9bc878cacf814ed7b69903ee44","sha512":"833411d5bd66dcb3bf2d786aa13f917dee33189e0e192f8f96ddc7831a125ab50081e441ff3d011196076bb83591a78c8ca64dfba513c46756da6914ff98a7de","ssdeep":"192:76DGE2c1uxbD1pGnQDuoO9s3eni6ohJtZ:TIMHG5oO9s3yi6aJtZ","tlshash":"f5d1ad94c2c9eda927a33182b7620b8301ec572da44327be080fa45e6e09e94ab31c43","first_seen":"2026-06-11T02:49:39.753609Z","last_seen":"2026-09-13T03:05:55.68649Z","times_seen":45,"resource_available":false,"data":null}},"time_used":187,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/bet_slip.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.770Z","timestamp":1789268705770,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/bet_slip.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 782\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-30e\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_24105-30065\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":782,"size_decoded":1428,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c63fa338ab5252ac19ec08849f37aebb","sha1":"46ff6aa9060456ce5c18f9c4205f184c80a563f1","sha256":"d3f6cda85f76d17d97f393cc510b1be383332d688d06d214cf7911ba5000c58d","sha512":"0678e177623f361582c8877c8010e1ac9a4f2d50471d56a02c28eed0d484494d7a4225b2535b95e082065d238f57f8ced243e97f587c7dd801c36cd9023a1ed5","ssdeep":"","tlshash":"f20125fd52a40bcd31500bd0aae97b487218f29a2f3c113abf426f659c20d7b340cc48","first_seen":"2025-08-30T23:50:55.281874Z","last_seen":"2026-09-13T03:05:55.687182Z","times_seen":113,"resource_available":false,"data":null}},"time_used":494,"timings":{"blocked":314,"dns":0,"connect":0,"send":0,"wait":179,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/statistical","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:15.696Z","timestamp":1789268715696,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/statistical HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:15 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612eb_PS-AMS-04DYH56_28018-9915\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":441,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/right_red.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.786Z","timestamp":1789268705786,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/right_red.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 23250\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-5ad2\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04h2Q194_44919-40728\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23250,"size_decoded":23895,"mime_type":"image/png","magic":"PNG image data, 120 x 179, 8-bit/color RGBA, non-interlaced","md5":"7b163b4464f665ed90db112da59aa134","sha1":"a04145c252f1329e6184e71a9bf3498ac705f989","sha256":"d030b29b7226b1b12d2f84046c07f10929a683b94d606ffdfd17829037d35a13","sha512":"ff30728c2f2462f961c9494830148a536a09b7e06e524cfc3803714793401c53c19a14024919deb62a9d3addb1ecb600d3496b8926f179f0491ce28f484e93ef","ssdeep":"384:b3CDujhGO8arelUy+JDwnGNtkalT3UsvWeN5+crDvps5niH7i2K8JrZtoA:rCCjhwrlURCnqJ+eRrDvpskbi27VH","tlshash":"f5a2e17bbdd5965f08284e124b366a3178c74694776804c69b6acbc2bcf7d81aec0f42","first_seen":"2026-06-11T02:30:28.026806Z","last_seen":"2026-09-13T03:05:55.687757Z","times_seen":70,"resource_available":false,"data":null}},"time_used":1394,"timings":{"blocked":1210,"dns":0,"connect":0,"send":0,"wait":180,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055uncsifdej595wqp3cbusgh7j3ft.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.285Z","timestamp":1789268707285,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055uncsifdej595wqp3cbusgh7j3ft.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 24444\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:58 GMT\r\nETag: \"1e1993cde5528902a57946295ebca0dd\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2140\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24444,"size_decoded":24877,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"1e1993cde5528902a57946295ebca0dd","sha1":"2e0d9f1976a6500dc83b086d30371f731361bf2b","sha256":"57ca4063b807a85916d8eab39587a5927becde56e5b6ee69e3fbb2b18263f036","sha512":"92b565eed93a5c8fa58709bae5a4879e71657b56f65cb5706283a6efccf4a922a0789a5ac9bba3d40786e22d9351bfd18b5701deebf0df1fef3b332dd5929499","ssdeep":"384:qJRpvQvQmm2zXCMOW8vxuq5xcGgCrD3/Fzi59V2zcDF4QU17cxm6TMh3EtTwrMoW:O32zXmRvx15x9N5+TUzcGCxm6TAUZ","tlshash":"6ab2f1c43f03452afd29cb3275f2a38673864c20edf8365b95618514e36139ea0ec7ab","first_seen":"2025-12-11T02:11:47.246115Z","last_seen":"2026-09-13T03:05:55.688361Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1110,"timings":{"blocked":1080,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/useScrollNode-C52eswgQ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.403Z","timestamp":1789268704403,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/useScrollNode-C52eswgQ.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:04 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 378\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: \"6a9e5e6a-17a\"\r\nExpires: Sun, 13 Sep 2026 15:05:04 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_24105-30050\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":378,"size_decoded":1031,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (377)","md5":"d5ef37a6ed4c7b646882fc732b90560e","sha1":"a0c37fb2ad9850f139d061fb43b9f64299d9dbda","sha256":"1820fa35f8a83a557f5134391997af7e129ca75afff7cd3e445d917069cd8c29","sha512":"3dff836204a2fae68ee972906914aef47abca89281c2a46c1a0aa3e989288e6289b0c097cac7f82387db7f8c2f3d68d0b617541243761386c600e0f01df4425c","ssdeep":"","tlshash":"0ae06198334a0230a2bd1582552f1d0d25116ba167db91d00509c8bb176047dd3dbf4f","first_seen":"2026-09-11T22:02:29.536876Z","last_seen":"2026-09-13T03:05:55.688938Z","times_seen":4,"resource_available":true,"data":null}},"time_used":419,"timings":{"blocked":241,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/mapValue?gameId=1\u0026key=oddsType\u0026value=Hongkong","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.444Z","timestamp":1789268706444,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/mapValue?gameId=1\u0026key=oddsType\u0026value=Hongkong HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: ed7264a768c2d4187ec63c294480a985\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_25562-30849\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":357,"timings":{"blocked":170,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkws7wgg8x5f0kqb8dl.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.273Z","timestamp":1789268707273,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkws7wgg8x5f0kqb8dl.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 33879\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:26 GMT\r\nETag: \"34303608f2d47ee2206edcd60457873f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33027\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33879,"size_decoded":34313,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"34303608f2d47ee2206edcd60457873f","sha1":"6d65ddb9aea19535696f79bd808e6eca260db184","sha256":"ea1f9bc2205f077dc9336049ab06d44a1926a9c0b4b2e6c893f0dd0f23dea13e","sha512":"61a16fcdcd9b19d4af1c77061d09ebd61f9cff426a096a7f7f17670c79c1d258c1d9bbc24538aa20c4f31aca425b91613b633782ca1fb267a681fbd62a5ea67f","ssdeep":"768:LPV098YXYRmmaQutalaz1VY02yPiXi2neBVyMA+yGpTNYI3K4vKr3N4TB4+:LujXYwb0az1VYgPiHQLyGpJYI3Kbrv+","tlshash":"b1e2cf3d73b9d743e3c6b9b02b8e48e9faca5d8460e40a4bf2c2257241ff1d858245c8","first_seen":"2025-12-11T02:11:47.370945Z","last_seen":"2026-09-13T03:05:55.689507Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1100,"timings":{"blocked":1070,"dns":0,"connect":0,"send":0,"wait":27,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedln8t8i05baa0mof85b.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.330Z","timestamp":1789268707330,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedln8t8i05baa0mof85b.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 69298\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"b64ab5bb0dedcebf89b27272e308fb9c\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3240\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":69298,"size_decoded":69731,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"b64ab5bb0dedcebf89b27272e308fb9c","sha1":"ef96de382f7fb20145746a1b135e1a323a350d59","sha256":"dac45913809586cfc7c20ac2a71b1837ba8d544ebc92af8b471b071fd979b628","sha512":"28617faf1e27015aaa492dd64c8d8982a765afb53179c4b7f119570c6597a8c1e32b5494b18c5a0c0f32c4ffe78030105e0d7d0ea52c2bc30e0601d09314c5a5","ssdeep":"1536:pFEXLSpqK7M1V22/B9VsWX/DcRMpSyo00YeL7z8R:pFE7SpqK7W2+3tPgR+SyvUv8R","tlshash":"086302b17300e8d91f22629d2e9bea3545d091e8477133cc7d6e18e844636cf9baae0c","first_seen":"2025-12-11T02:11:47.142787Z","last_seen":"2026-09-13T03:05:55.690097Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1278,"timings":{"blocked":1246,"dns":0,"connect":0,"send":0,"wait":27,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedllbauf0pu920ky67eu.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.337Z","timestamp":1789268707337,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedllbauf0pu920ky67eu.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 66143\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"14fa4c193ffae660747492ef818535c8\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3242\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":66143,"size_decoded":66576,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"14fa4c193ffae660747492ef818535c8","sha1":"242bfe98a649c156114287a4a3290434f5d1eb79","sha256":"4bd4df9263a8cdd895f638f158d1ba9f7adbc3ff100d05c734dc5e1c3a0770f7","sha512":"bc8fc073c13d0f620830fef3be8e2c1d23d1a3832ded6c5062f98c6b14743de6d4dc19e6faf3f3d6d7d9437d264e7320b13fe27cdc91f468491932596c46be27","ssdeep":"1536:Uc9H/BbTuL4qQyJs0paRhg2DNeayeKgUCwGYfn:Uc1B/uL4jyJxpOhXbKgUCwvfn","tlshash":"035302f19ae946d509427c5e0acc9fdb00f753a6ea851f8119128a049f11fec3fd953b","first_seen":"2026-09-06T17:58:09.552361Z","last_seen":"2026-09-13T03:05:55.690632Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1271,"timings":{"blocked":1233,"dns":0,"connect":0,"send":0,"wait":28,"receive":10,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/statistical","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.426Z","timestamp":1789268707426,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/statistical HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_30356-9181\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":441,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":342,"timings":{"blocked":104,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameBrandList","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.271Z","timestamp":1789268707271,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"GET /uapi/game/gameBrandList HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268707\r\nx-cq-sign: 9805a239e207bce4b9bf792b9a8732085d44326d7166a703f12d215963e26d0d80ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nCache-Control: public, max-age=5, s-maxage=5, stale-while-revalidate=5\r\nCdn-Cache-Control: public, s-maxage=5, stale-while-revalidate=5\r\nTrace-Id: d4bfcf1d69c2d418e7a7b35c5dcafba9\r\nX-Cache-Key: /uapi/game/gameBrandList:3dd0743699f8dd1d08f29e813e035675c1fa71ee\r\nX-Backend-Time: -\r\nX-Cache-Status: MISS\r\nx-via: 1.1 PS-CDG-04koU196:33 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_50987-6423\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8058,"size_decoded":8993,"mime_type":"application/json","magic":"JSON text data","md5":"23e0f1905d01673812c247ba100c6b53","sha1":"40d71526f996abca2a6a5041cf003980ccd9fc74","sha256":"674087ce5c2a454f73184d5f6549158ad077bbac554b5a5452aa188386724e98","sha512":"cf0c0b60f57f2ef3b4fb7c03ab0d2b048cf717050f54175b8c1e587626d210a11bcb1d3cc064b3254b84a3b8a67fe1fe1a8e245ac6d815bc7a37def264ea649a","ssdeep":"192:+0hIP9uLEWuROkD9lu6drA9vkvuL+buVusl03nIYyA4GO8ux8gcuVusXXGPWMfiT:Fo0ysFv0YH0KtSmfrx0o","tlshash":"34f1e1a7614c2c4d4f045bc39cd7770ea4974187a8eca8d6d989ee1ed6b46e0ac0bd33","first_seen":"2026-09-06T17:58:09.747538Z","last_seen":"2026-09-13T03:05:55.691174Z","times_seen":6,"resource_available":false,"data":null}},"time_used":189,"timings":{"blocked":4,"dns":0,"connect":0,"send":0,"wait":185,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqht7ubft1klxrvokcq.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.852Z","timestamp":1789268708852,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqht7ubft1klxrvokcq.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 9326\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"a7282c4024df8e3e40939a923999a4ec\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04uki195_1027-2150\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9326,"size_decoded":9757,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"a7282c4024df8e3e40939a923999a4ec","sha1":"b07204243b720d928e142b10206b0d59f4770629","sha256":"b3f859fed4014baa097c9a6d78f568cde188bd3bfd1ed29a14a7cff1b9afc06a","sha512":"236477300bc2cef18c5c840fac9d8ef1424c5dab6e0425d74babd1dad017d850b31df71872e6414b215aa83846ca9e821f5f8ba38d1837b632561e5f8de13b97","ssdeep":"192:ReO4+xrlZweeZ9YkiK83phqLYJKzexrYcoZoNX/0+y:RekrlZwdTiK0DqLYozeOcCoNXs/","tlshash":"1112b0cb8c9004e5e5d0f9bf84dddb6be007686413a49e5a9c17a3f015b98816e75f0b","first_seen":"2026-06-14T14:24:21.396475Z","last_seen":"2026-09-13T03:05:55.691784Z","times_seen":42,"resource_available":false,"data":null}},"time_used":173,"timings":{"blocked":144,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqkuozxidqv5pgvp8pk.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.857Z","timestamp":1789268708857,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqkuozxidqv5pgvp8pk.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 2547\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"2ae0ff5f376d1047d2c3f158cabeed38\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04koU196_48246-7797\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2547,"size_decoded":2979,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"2ae0ff5f376d1047d2c3f158cabeed38","sha1":"3dcc149cbb1f1ec971c3de1fedbb233f159ceea4","sha256":"d727222ec0ffcaa9828b4f8f71bbb18f9cfd06fa9b5457ae4de6bd3614c47eda","sha512":"cc5fce00d292b0a05a6ffdc6ab9c8578b4696ea274af8aff71d34b13d584cadc6392b69ece53ae911620e54c9ff2e62692d2b913f5049ced162d8fa467cba82e","ssdeep":"","tlshash":"d0513bac1d197010c4dbd9765ddc6dcb4c528f0379473754674e638e811b1079753ae3","first_seen":"2026-06-14T14:24:21.41514Z","last_seen":"2026-09-13T03:05:55.692387Z","times_seen":43,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":146,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9t6osek465h707p97ul.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.246Z","timestamp":1789268707246,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9t6osek465h707p97ul.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 83232\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:44 GMT\r\nETag: \"7aab9aea70a762bd64e8b00af23f0b4f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2136\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":83232,"size_decoded":83664,"mime_type":"image/png","magic":"PNG image data, 448 x 604, 8-bit colormap, non-interlaced","md5":"7aab9aea70a762bd64e8b00af23f0b4f","sha1":"441788000d9319a0957256ed4087f2b91d49e15f","sha256":"9be15e043edecf11bd6bdfb04855902f6565b4effd81019dd54d883777d5e424","sha512":"0afa4a06d69e1bc8a87d5270bf30e4dd7221c74d1a9732b03eb605a3f47bb697ca73b6686e464f7476edee2ba718964ed25615e93a6ad4d15904384cc0166ad6","ssdeep":"1536:XyIEdl0S0WZmj/IlKfM1SfHabAFzLHmhh0kXpINnLJCnmnRJKcNUlhN870cBpjC:XyIYOF7IEf881kpuNLNKiIhNsPpjC","tlshash":"c68312ca7d3faca8a5c2c4677c154d4319362b6e1c4a70eac6d07e41c8de093b8ab760","first_seen":"2026-06-14T20:28:34.22496Z","last_seen":"2026-09-13T03:05:55.693044Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1006,"timings":{"blocked":973,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.961Z","timestamp":1789268706961,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 153\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":153,"data":"{\"type\":2,\"sportId\":1,\"leagueIds\":[17663],\"current\":1,\"orderBy\":1,\"isPC\":true,\"oddsType\":2,\"beginTime\":null,\"endTime\":null,\"languageType\":\"CMN\",\"size\":1}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nContent-Length: 97\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: 45226f4bdb174a719\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_28847-10794\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92,"size_decoded":595,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"e4662bc44588377e782fbce985062799","sha1":"2987db379501adc2e2bca61f781019807920c97e","sha256":"358d7afa85146a073a8eac196998feb68f56d889bb126b05f38eca84fca2db9c","sha512":"3a819045f743ff4fae408526cf42ee34e7681f99eb7603292ad3985da9667553775c2ff84ea69893380b9071f4c4e0f8c377386587965d1ee3c4f343591da958","ssdeep":"","tlshash":"26b01209440c0272f24191c5102b251287bb210a1d100a0089ec834c8d0e0092182006","first_seen":"2026-06-01T18:09:18.929363Z","last_seen":"2026-09-13T03:05:55.48538Z","times_seen":32,"resource_available":false,"data":null}},"time_used":337,"timings":{"blocked":96,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqh04kbpq1hzbgdi51r.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.851Z","timestamp":1789268708851,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqh04kbpq1hzbgdi51r.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 8708\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"39e67afa4dd545ddce55f0e5b84f074c\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04uki195_1027-2151\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8708,"size_decoded":9139,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"39e67afa4dd545ddce55f0e5b84f074c","sha1":"c4bedc24f446a78c719368991593b4a4122c9ffc","sha256":"74ab73f03206159c0486e58df304f225a95267ece11e4eb6639fa8a36a0f6ed3","sha512":"50b4bfe6f3f720aef2190656d74adf95ddb31ed1757275d3554ceeb62e617ef3d3053efed79d4a7c9aff65461c76b7f01a2410c55a36a75355ee942d3460914b","ssdeep":"192:o1Hzx4rh9N8LtZ/lJfk1wibj8uCpyUZ3d5O8Glyvb5cWCCyc73N:4Tx4WLtRnk1zbYDDlfO8Gob5NCrW3N","tlshash":"4102bebbc531410deb0a96369bde9fb10b2907e2d100ccc7af518e617e82b12e96f147","first_seen":"2026-06-14T14:24:21.381306Z","last_seen":"2026-09-13T03:05:55.693631Z","times_seen":43,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":177,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:09.178Z","timestamp":1789268709178,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e5_PS-AMS-04DYH56_28018-9804\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":441,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":239,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":239,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/game-DUAqcE5r.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.097Z","timestamp":1789268707097,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/game-DUAqcE5r.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 32576\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: \"6a9e5e6a-7f40\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04h2Q194_46621-35460\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32576,"size_decoded":33221,"mime_type":"image/png","magic":"PNG image data, 235 x 176, 8-bit/color RGBA, non-interlaced","md5":"204f37639a5086ef12170d4040b937b9","sha1":"1833299d909ef6245363bc070917ce4f7b553949","sha256":"4aec35afc18cf03d2601b9072a7bdd4ba639651fa7429a0ff308d5be712116cb","sha512":"02298d63934e6990f04067feca4d482e853b73eb91e7e88209ee10038cdfd3510ab54d73fd11f16f05d02fc72a2d8448bfebba77154aec8452cd867196f2a74a","ssdeep":"768:26pzOENDq4BgdxJyEUPwAl3YJdlfx0wYMlFUM5pjDGhz:2U5s1xJWPN3YHRWwWM5py","tlshash":"7ae2f065b45a0eace819604825c8dcd9b906356c34b864bb75b3bb8f81f803c7cb275a","first_seen":"2026-06-14T14:24:21.595041Z","last_seen":"2026-09-13T03:05:55.694226Z","times_seen":43,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":55,"dns":0,"connect":0,"send":0,"wait":179,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/DIN2014-Regular-CSwXwq2Z.ttf","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.756Z","timestamp":1789268705756,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/DIN2014-Regular-CSwXwq2Z.ttf HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/assets/style-BAEGjb_c.css\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: font/ttf\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-25ec8\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_44919-40717\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155336,"size_decoded":69640,"mime_type":"font/ttf","magic":"TrueType Font data, 18 tables, 1st \"FFTM\", 24 names, Macintosh","md5":"924fe66b65c751bb39e973ac23055472","sha1":"78416e4a608232e0de3e4ad8386977c240a5a8ea","sha256":"520a769eec0b69a27eba95806e0ee5af0243a02871fa4a6017722b4e45fe1123","sha512":"b3c2417940d78afd319cd08f45547196cbd5c65f032378e61af98285c12cc63d56e9925c8a7ac9a9e6bdafe45d4a5852a9bac1f889d8b95bf67a1f56da33abaa","ssdeep":"3072:QT0aJGMiQdYKhrqvOBYtezUPy1aw+C4cy+yaNHBU0+5uoDkYzNjc9npHg:QTT2VXvOBYteloC4cy+yaNi/5/Az9pHg","tlshash":"a6e32992f246779ecf531c368960829dcee1c93fd9e80fb79e722ca359154b88d50d88","first_seen":"2025-03-14T20:40:58.474195Z","last_seen":"2026-09-13T03:05:55.695424Z","times_seen":117,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":135,"dns":0,"connect":0,"send":0,"wait":183,"receive":13,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzktqjm3o334n03jtbgs.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.262Z","timestamp":1789268707262,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzktqjm3o334n03jtbgs.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 50589\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"72125114c75eebbe737e1d9301103e16\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2138\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":50589,"size_decoded":51022,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"72125114c75eebbe737e1d9301103e16","sha1":"5edd5b069958d054bf72c6f93e7de3e02905aef9","sha256":"f3d8470a9435a4fb933c29bd6bca2be818bf7e5e09e2de14df482b2204297e72","sha512":"e62376af5ab0425936f987e096529b9320bebacbba5b7fc70511e68b7eda83c21db04ccf43701d855e62c66bab10b6ef40097deb38944e823640e81c9d95a1b2","ssdeep":"1536:Gx3vLoqk3MSh6Z16G+ClSlMVm4ZVSrA6C:Gt3146ZgG+eSlGm4Z9B","tlshash":"c533e1133a29971af710767a81d7827fc3165ad2531631ac87320a5cf9d1c79c27edca","first_seen":"2025-12-11T02:11:47.284182Z","last_seen":"2026-09-13T03:05:55.696063Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1064,"timings":{"blocked":1033,"dns":0,"connect":0,"send":0,"wait":27,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-CoxNcPbx.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.452Z","timestamp":1789268707452,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-CoxNcPbx.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-1819\"\r\nExpires: Sun, 13 Sep 2026 15:05:07 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04h2Q194_46621-35461\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6169,"size_decoded":2932,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (6168)","md5":"1ca49c0d4da220b1824ac69d478d8a98","sha1":"3ab7fff17690ba444adaa0601d892bbeea07ea1e","sha256":"a5e494fb4d236d926ecb8f93be3e082c30779401b2d91ecdf6dda7c28367d54b","sha512":"57b322e680c0b15603829752e3093a55b54fb6f99779f787db635f240fe5aea8f623e3c49254f726a69d73ad87401777e6d29cb18bb28987cae0861305b7c391","ssdeep":"96:ADN4lU726n2dL/e2fpSmhCjhFfsWgwuZcPbqT7ytZwNsMjt5:UN4lU726n2dLmipZufHgwnP+ytetZ5","tlshash":"60d1c65274dcb577caaf8072902548b0a33407dde41c87fb53b4672e2e8fc6419e6e69","first_seen":"2026-09-11T22:02:29.370716Z","last_seen":"2026-09-13T03:05:55.696749Z","times_seen":4,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00005.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.338Z","timestamp":1789268704338,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00005.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 37774\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-938e\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04koU196_50640-6022\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37774,"size_decoded":38418,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"cb5af992f425983ad6613d29782e4ed8","sha1":"07255c49a26e1b2e4f003be425b60eb80732cfeb","sha256":"1d770606932fd628c9ffdbd7ea212edb3663eaa6ce7b426c715d1a474ddc920d","sha512":"84a798f4ebd63beaed75e51f176f9f05881fedd1ed886064708aefa15e48a6e62aecb89ce00aa59162da3efa6e61fe02438dd8bb49a790387f6da3d05ee363f0","ssdeep":"768:bYgmQuz/dq2eNKHfyF2xJjWWwbfaffptrX9xQCf3c1iS1H1u7VR6y:bYgm//dxeNKaFMJ/EfGp99fPckS/WV","tlshash":"5903f178170df0f7d9e2997b6a54b5998b87e16cc4d55b62a2fdf852b02c2f411c00b3","first_seen":"2025-03-14T20:40:58.452424Z","last_seen":"2026-09-13T03:05:55.69743Z","times_seen":124,"resource_available":false,"data":null}},"time_used":1130,"timings":{"blocked":945,"dns":0,"connect":0,"send":0,"wait":179,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameSubHotList?lang=zh-CN\u0026currency=CNY","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.819Z","timestamp":1789268705819,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/gameSubHotList?lang=zh-CN\u0026currency=CNY HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: a8718b7768c2d4181aa7b35c150e6f31\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_29158-31954\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkw5a25y02530845lbh.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.266Z","timestamp":1789268707266,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkw5a25y02530845lbh.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 35251\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"17d62a1936b45e2ca88d600a706f1eca\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33026\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35251,"size_decoded":35685,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"17d62a1936b45e2ca88d600a706f1eca","sha1":"9518046cd16601d0e94a736b5163b50df41549d0","sha256":"198b16d6b0430d2b400668901ca684b489cf350337e10e4d23da8d10ec0c0e0f","sha512":"87a41a8e801e8c299a1cdcaee2b00d63f2230a4f4540d35533ed5ec6df5acbe3222b3b64ccab31976ca2878d43c23982455902e5f58b0896c37791e960d350c0","ssdeep":"768:BuJAghAVmsvZ/89G5ehJs31EOG6GPiY4OjnKkdUCaBpvedqBQkh:Biqj8TJs3nG6G6YH8CaBpvOqBQkh","tlshash":"53f2d014f6dac623e78dd73add1d4baae098353c3640d33993a53d76a25e3f08b62040","first_seen":"2025-12-11T02:11:47.356906Z","last_seen":"2026-09-13T03:05:55.698139Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1076,"timings":{"blocked":1046,"dns":0,"connect":0,"send":0,"wait":27,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7j8yrg5wj1fv94b1j9.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.201Z","timestamp":1789268707201,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7j8yrg5wj1fv94b1j9.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 95277\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:15:01 GMT\r\nETag: \"c78ee920a9b79d8d0746dd40d2ae4481\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3227\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":95277,"size_decoded":95710,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"c78ee920a9b79d8d0746dd40d2ae4481","sha1":"25f54ca54800d0b89c48a38001cb42566069f379","sha256":"3de592ff1343f511f29a7d63e2e8dc446861d1e3b64b502ebb9a41004b8a7217","sha512":"f17e1a9e4b428c77894892fab4cf89d07c870603ca374f5f831be27a754409ca821e407d0ef94f27712495b3e6e1b82c0d1f792af70b089c0932506dc10809f9","ssdeep":"1536:fFcxO+rzb6TYmfu21uD3gI2yOf6RX9MUH6Afwj0/51tu2Kzzvf+cHiz:fCx7boYmX1EgBl6RXBlKzzRHY","tlshash":"a49302fba23785f74a5ee8a73496b8503bb19cf76143c4fb500d47f6ed01849228168e","first_seen":"2026-06-14T20:28:34.115413Z","last_seen":"2026-09-13T03:05:55.698996Z","times_seen":37,"resource_available":false,"data":null}},"time_used":949,"timings":{"blocked":909,"dns":0,"connect":0,"send":0,"wait":28,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00017.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.358Z","timestamp":1789268704358,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00017.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 25596\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-63fc\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_46621-35451\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25596,"size_decoded":26241,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"58a649914d644f54152cf3690fa41c1b","sha1":"5c19606eb3f667444f05b903c0f01bceec3ae23f","sha256":"77c782c76a32eaec6cb9994da6ee2fcce568031b0d62b00a973d0ce74c9a4d8e","sha512":"ff8f85c18db8ad9e42b5fadb070b1906e94596cbfcc9f41c724b958ed32f6c1d8f12b12bcedee49b7e3b2a702acbf7c03e6c96fd1c4f96d85d403e56ec660975","ssdeep":"384:HJonWHac9uvzfb5+JPyrUZTHblJm3Fmz6hKCD+up5XHqcqjLIL7Cj:H2nWH9iDb5+J79Jm3WnCyA5XqvILG","tlshash":"acb2e084cec3c780e451e172b36e9ef05672359a38c7921243ce2d9aa57491136cef88","first_seen":"2025-03-14T20:40:58.525468Z","last_seen":"2026-09-13T03:05:55.69976Z","times_seen":115,"resource_available":false,"data":null}},"time_used":1473,"timings":{"blocked":1291,"dns":0,"connect":0,"send":0,"wait":178,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00034.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.392Z","timestamp":1789268704392,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00034.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 15907\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-3e23\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23850-31938\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15907,"size_decoded":16552,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"3239c89a26153e436492b5d0808faa97","sha1":"c7ea7eabfe096b7570d368dbf4142322bd81f819","sha256":"23fed93fde26619c85e1452937416ceac78ff870de797c4a2c8a9c442fcf0c71","sha512":"1c56ff494a3793b5f33f75717a66a750afed1a4997b992bfb9fd110007ea2d61a21e06a4d66dbe8de0f739d45effbeaaf90dbd7dcef453dcbe04ed75f146bfac","ssdeep":"384:VmsMYvfxf163EjUaL8MzgtzYIVIe6FIF3Yq4q6:VmsMYvHOAXvzg2I6+lYE6","tlshash":"cf62c06f567afa40ce5ced7426e9c854d4b2a9bd7c471fc22982ec9725a3f0c07008ac","first_seen":"2025-03-14T20:40:58.464471Z","last_seen":"2026-09-13T03:05:55.700651Z","times_seen":113,"resource_available":false,"data":null}},"time_used":2625,"timings":{"blocked":2439,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/AlimamaShuHeiTi-Bold-oCKVoyDz.woff2","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.110Z","timestamp":1789268707110,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/AlimamaShuHeiTi-Bold-oCKVoyDz.woff2 HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/assets/style-BAEGjb_c.css\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: font/woff2\r\nContent-Length: 569740\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: \"6a9e5e6a-8b18c\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_23238-37996\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":569740,"size_decoded":570315,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 569740, version 1.0","md5":"5e812e69dc03b10783aa444efea7e94f","sha1":"12516b94783e11c59d333f16c9aa03842cc0933f","sha256":"f64b19a15c9df98c0b8f6dc6db0b3c86267b0de7acf951935d9992faff02cf29","sha512":"aeca1dc4caf3b4091433fb014c8f18a8602172e1eaa0072edfd095fc9bd6d2740cab42fc9a161e51ece10403151e7ed5942c19eeb553fc9c0a6594fc712765a4","ssdeep":"12288:jyIpFN9SopnD6IPYALwGA6kYJJCUBbePee+9BuNNtEY:jyIpFaAOiLw36CECPqBI","tlshash":"afc4230683316e4353b6e4fd6bfcb52374a24a01bf1282f81de0895217bf6611992fdb","first_seen":"2026-06-14T14:24:21.560076Z","last_seen":"2026-09-13T03:05:55.701449Z","times_seen":43,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":38,"dns":0,"connect":0,"send":0,"wait":176,"receive":150,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/favicon.ico","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.233Z","timestamp":1789268704233,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 13 Sep 2026 03:05:04 GMT\r\nContent-Type: text/html\r\nContent-Length: 146\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_23850-31917\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":633,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-09-13T04:11:17.606406Z","times_seen":558956,"resource_available":true,"data":null}},"time_used":189,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/lottery/tone.mp3","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"media","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.425Z","timestamp":1789268704425,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/lottery/tone.mp3 HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: audio/webm,audio/ogg,audio/wav,audio/*;q=0.9,application/ogg;q=0.7,video/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nRange: bytes=0-\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nAccept-Encoding: identity\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: audio/mpeg\r\nContent-Length: 20530\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-5032\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nContent-Range: bytes 0-20529/20530\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23238-37982\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":20530,"size_decoded":21152,"mime_type":"audio/mpeg","magic":"Audio file with ID3 version 2.3.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo","md5":"98ad3db9b9cc9ecb4d86146ec575c834","sha1":"fdbc4e7ffb7737a74435f786ed7505180494ef15","sha256":"4b3baffe4782d1587b0ba422e48eb1b80be330f5379cd4cdb8ac87a8d0218c73","sha512":"59a3257cd998878b6fcd686ad85a8f96c3dbf69d4b90320b81ec93a8b9074cdcfdf0d389eda11bb1fb4f81addc40fab86507ea8356f6b0f439257f63e73ea05a","ssdeep":"384:kwqK4pAPmgI0PcXNq7PEqZ5gMUHzRj10ldlXP+8NpSDL:7/mv3NEP5gB1jOt/+kSDL","tlshash":"3392bea68ba377267342177cc5cff211c41a9e2c1c56dfcc22820b9154bfca533b5946","first_seen":"2026-06-11T02:30:28.001036Z","last_seen":"2026-09-13T03:05:55.703027Z","times_seen":82,"resource_available":false,"data":null}},"time_used":942,"timings":{"blocked":764,"dns":0,"connect":0,"send":0,"wait":177,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"hlist.s3.ap-southeast-1.amazonaws.com/domain/filename.txt","fqdn":"hlist.s3.ap-southeast-1.amazonaws.com","domain":"hlist.s3.ap-southeast-1.amazonaws.com","tld":"s3.ap-southeast-1.amazonaws.com"},"ip":{"addr":"52.219.184.14","port":443,"asn":16509,"as":"AMAZON-02","country":"Singapore","country_code":"SG"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.280Z","timestamp":1789268704280,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3-ap-southeast-1.amazonaws.com","organization":""},"issuer":{"commonName":"Amazon RSA 2048 M01","organization":"Amazon"},"validity":{"start":"Thu, 09 Jul 2026 00:00:00 GMT","end":"Fri, 22 Jan 2027 23:59:59 GMT"},"fingerprint":{"sha1":"C8:C0:88:DE:84:24:F2:2F:A4:DF:96:16:D3:BB:30:BA:A5:4A:9E:B8","sha256":"A7:6C:D9:08:B5:3A:A8:3C:70:FF:9C:84:99:2A:77:A9:04:93:75:AE:FF:74:49:D0:00:F2:A4:96:3C:E8:D4:15"}}},"request":{"raw":"GET /domain/filename.txt HTTP/1.1\r\nHost: hlist.s3.ap-southeast-1.amazonaws.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nx-amz-id-2: pOcJfOUW/FS1DKbAp0kSxL0rkH6I2sXiVFjNBt5H7HjnauhbelvCL5jw24OcS9HddlgAIwGX1mw=\r\nx-amz-request-id: YGFE38MV2F6A70BC\r\nDate: Sun, 13 Sep 2026 03:05:12 GMT\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, PUT, POST\r\nVary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method\r\nLast-Modified: Sat, 12 Sep 2026 03:08:28 GMT\r\nETag: \"e7cf6103f1df7393fe9011f86cc18354\"\r\nx-amz-server-side-encryption: AES256\r\nAccept-Ranges: bytes\r\nContent-Type: text/plain\r\nContent-Length: 2100\r\nServer: AmazonS3\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":2100,"size_decoded":2651,"mime_type":"text/plain","magic":"ASCII text, with very long lines (2100), with no line terminators","md5":"e7cf6103f1df7393fe9011f86cc18354","sha1":"b59b4b74daf336a50edb7f7f7e514177fdb5a102","sha256":"8721367f41ee9bbe3b62b91b216e0f84c37b1dda1f25babedeeebd096d1ad2f2","sha512":"6130a0ddaac1c1eabbffaf2ed07cb59001f19250e6d4db1b3bec044273ed618c904e105b4ca30bf45ba9f88279026dc05c761423bd6c1075e0ad032b468b385a","ssdeep":"","tlshash":"59413a16bddca0633f421b3731b4172351171a925b912acabbce7d3e71649000e3e35d","first_seen":"2026-09-12T17:28:41.410104Z","last_seen":"2026-09-13T03:05:55.703789Z","times_seen":3,"resource_available":false,"data":null}},"time_used":7360,"timings":{"blocked":0,"dns":15,"connect":260,"send":0,"wait":291,"receive":0,"ssl":6794},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/logo.svg?v=1","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.761Z","timestamp":1789268705761,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/logo.svg?v=1 HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-a22\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23238-37989\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2594,"size_decoded":1854,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"10062b0b9dcd062a152232c25a537dde","sha1":"0cd2fb4247e9f782611b71b961fd9ace885d6025","sha256":"d77e9e878bc5c985adaba683ba82a4d5fc9e2e9e9efb133f87770df0043ca2b8","sha512":"b7f900b8960c6cb5558c4760ddc415ed8f841951610fb2fbc4ecc010e7d2d45c52dc7a419d58f0feab19370d4a8811fd434d8fa2c7d1f40555400f41256877cf","ssdeep":"","tlshash":"105110bc59c1c3b1198cf3e54644506d750360e537e246fc91d26a2af81a6dd8e44fc6","first_seen":"2026-06-11T02:30:28.081991Z","last_seen":"2026-09-13T03:05:55.704944Z","times_seen":75,"resource_available":false,"data":null}},"time_used":319,"timings":{"blocked":143,"dns":0,"connect":0,"send":0,"wait":176,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00014.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.352Z","timestamp":1789268704352,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00014.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 33476\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-82c4\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23238-37986\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33476,"size_decoded":34120,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"724f30fb74257537482647b2c62cb380","sha1":"8c6ccb3f3425507dca54ee05507692136d680f18","sha256":"6673cd6bd8cce20ab2bb6f15d6dbe494434f67356ab334d5b4bcfb8aee9423ca","sha512":"7d39d3a07217e11260260ddb72d56125a8579e7b689cf1a226712f9883e53c082cad15cffbe05f09db004a2276ddff822d746a0d8244d2166626118a2bccf18f","ssdeep":"768:iEI5UwRxSDoIQLus8M2Rj0ca7U0bix/xcxRussgE+9QO:i9CUQ5QB2RjI7Tbix/mxRueE+WO","tlshash":"4be2e1e726001070c608a3b8a610e2b528c9677e7f4fd2014f7ed09b71a7db7b565e5d","first_seen":"2025-03-14T20:40:58.46169Z","last_seen":"2026-09-13T03:05:55.706058Z","times_seen":116,"resource_available":false,"data":null}},"time_used":1335,"timings":{"blocked":1156,"dns":0,"connect":0,"send":0,"wait":177,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkuoom675c4q0exr950.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.263Z","timestamp":1789268707263,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkuoom675c4q0exr950.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 47989\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"b1464cca1cefbb80f8723f680cbd1b60\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7782\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47989,"size_decoded":48423,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"b1464cca1cefbb80f8723f680cbd1b60","sha1":"ed5669f76eca95f91bd76d904cd418253c59c0ca","sha256":"8b785f6818689c8301b35409c180f5bd63f33757ca4b211567c84ff9a9f758c2","sha512":"e01bf7b2f06f18137f2aa11a8afa0a1b03dded5d6f9ae083f3cfa5fc1f78416c3dc683984077fd0d36c7c6e93763acec09505103cfc79f09fd58cfeaf1b6b586","ssdeep":"768:6ZUmYdMaL2cojWDTOmyxW0x+vLs3hWcBVfhkBh4kms5jdC12RmuM3mrWIuvimFuG:6yTojWDKme+DWWSVZ4z/8uypgmFuJKMo","tlshash":"3223e1a2a3f5e743ee76dff4968d2611f156a85eb606ebfce4c06d7405ce68c0c8a005","first_seen":"2025-12-11T02:11:47.398244Z","last_seen":"2026-09-13T03:05:55.706989Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1078,"timings":{"blocked":1046,"dns":0,"connect":0,"send":0,"wait":28,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.957Z","timestamp":1789268706957,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 153\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":153,"data":"{\"type\":3,\"sportId\":1,\"leagueIds\":[17663],\"current\":1,\"orderBy\":1,\"isPC\":true,\"oddsType\":2,\"beginTime\":null,\"endTime\":null,\"languageType\":\"CMN\",\"size\":1}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nContent-Length: 97\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: 6a4e26f4bdb105d10cf\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_35724-11833\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":92,"size_decoded":597,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"e4662bc44588377e782fbce985062799","sha1":"2987db379501adc2e2bca61f781019807920c97e","sha256":"358d7afa85146a073a8eac196998feb68f56d889bb126b05f38eca84fca2db9c","sha512":"3a819045f743ff4fae408526cf42ee34e7681f99eb7603292ad3985da9667553775c2ff84ea69893380b9071f4c4e0f8c377386587965d1ee3c4f343591da958","ssdeep":"","tlshash":"26b01209440c0272f24191c5102b251287bb210a1d100a0089ec834c8d0e0092182006","first_seen":"2026-06-01T18:09:18.929363Z","last_seen":"2026-09-13T03:05:55.48538Z","times_seen":32,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9tey8mq0k9jf0a8c2i8.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.248Z","timestamp":1789268707248,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9tey8mq0k9jf0a8c2i8.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 98099\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:45 GMT\r\nETag: \"104ed05010eda5c6588010304e7411d0\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33023\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":98099,"size_decoded":98532,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"104ed05010eda5c6588010304e7411d0","sha1":"beb30b26ac08276c9abcedd0cc55ae69a292ef8e","sha256":"0dcd544a8bcc4396f9b79808ae1e85130e6d9ef2900b11f6c69fb55256d4bc66","sha512":"6398dcbf43821fcb782fb48b3ad471dea8797facae4096dcd796c197bdffb4b4a00a8c19405eb80fdafd5fed612d5e401de249de2705782623b557383876c738","ssdeep":"1536:CqQR212vHlNp+CTqWpHWcmjnq7Q6cPm7k2TiNluXe5dDHx1MV1MFLrqBlwSc:DQ012dP+CTqWp2zjnN6l4Kizzb+MFLrT","tlshash":"5fa312a02e260677ac15f2ec220933bdb45d14d8d2df83749c65afbd0ff249995a834e","first_seen":"2026-06-14T20:28:34.308107Z","last_seen":"2026-09-13T03:05:55.707832Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1021,"timings":{"blocked":987,"dns":0,"connect":0,"send":0,"wait":27,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00013.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.350Z","timestamp":1789268704350,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00013.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 34913\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-8861\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_24105-30057\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":34913,"size_decoded":35558,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"baed14140e1769c44407589a48f42b86","sha1":"671fcb2b2c5fef75668eb2fdb25b03539be7ecf9","sha256":"04b4af0226c20f14668a224a02a50b7dab1b7f9469e0b08994a6fac6a5a63434","sha512":"c2003f2148cb977fe9b389a3d40b7218dc3b33a146250667e1ddeb47fd01b44473b3e7984b8e0d8cd20088cdb557ba40ebef4ec9e07a03edae5cace5a7eb4a52","ssdeep":"768:COsLqk/MDUAbD22tQKMqSl1DqHr3x4Jo84y8zKqxJyyAsbHPmcB/40hh:1smYM4AbD2/RtlpqLS+8bWKqKydz+cBz","tlshash":"6bf2f126819f4af1f44bcaff1461c608a06e6955323b1046d2ae50f50aedcff44ccdda","first_seen":"2025-03-14T20:40:58.492533Z","last_seen":"2026-09-13T03:05:55.708742Z","times_seen":118,"resource_available":false,"data":null}},"time_used":1326,"timings":{"blocked":1141,"dns":0,"connect":0,"send":0,"wait":179,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/weekleaderboard/config","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.809Z","timestamp":1789268705809,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/weekleaderboard/config HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 81242c8668c2d41834a7b35c10d3de54\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:35 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_2046-65481\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":718,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":423,"timings":{"blocked":236,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkwxgxmdmh5i0suo5o3.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.274Z","timestamp":1789268707274,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkwxgxmdmh5i0suo5o3.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 46328\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:26 GMT\r\nETag: \"83bb6b4859338fa85f80b40f725a0897\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6967\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46328,"size_decoded":46761,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"83bb6b4859338fa85f80b40f725a0897","sha1":"409a2f460de7420f69c3255547a4bfe7ee47f1a8","sha256":"0687de064cdfe5552bfe304e569802b53f22b1917952e1645153b2b75bb65923","sha512":"90dd45cb1b97ec68357b566ae9650f73254dcedaebede9d2ae2f3c96766eeb0e1025833e5ec979decf0c73950c688c0501e8b53471502ad8b3152f42511f0e74","ssdeep":"768:pDPnfswEz5GM/jIVYKWbxJ+bnw1BLz6ZkYX7cwPv2Dp3+8tjm5h9YvhpZ:pbUrz5G1VCNCnb4y0rUTYvN","tlshash":"e223e03873f808b3c0d2e936192a17b6510ddd2496e8d7dfd8802f49b4662e2ee3bd05","first_seen":"2025-12-11T02:11:47.187729Z","last_seen":"2026-09-13T03:05:55.709774Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1101,"timings":{"blocked":1070,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00000.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.331Z","timestamp":1789268704331,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00000.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:04 GMT\r\nContent-Type: image/png\r\nContent-Length: 15843\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-3de3\"\r\nExpires: Tue, 13 Oct 2026 03:05:04 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_24105-30048\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15843,"size_decoded":16488,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"e6dd90d5a7820608fe9091bedb7e62e2","sha1":"911300147a94af3fef9995bf2ba58fcbcbb66af1","sha256":"6733b4472747a0567fff341141dcb3dc7d3cbfb68e228a9a251737539ea54dea","sha512":"d6ba8cde9b85f09b8aa3aa5dfe560f7378de901e0161e10c023bd4c648cf381b84ef8d0c594eba237b61e50e6c378a6f0b09094a556970ddd9e6ae794d6c0fa4","ssdeep":"384:dBWV+o6Agf6s3LUjqI2AdWXF3GB1FrFpr5LHa/7MWxjkpyTa:dEMlTf1AjqITWlKzlSwWima","tlshash":"3662c06623bfc9b6dae511331fa5742d8c63502b60bbabc45b94cc22cadaf05f5c8106","first_seen":"2025-03-14T20:40:58.536364Z","last_seen":"2026-09-13T03:05:55.710763Z","times_seen":128,"resource_available":false,"data":null}},"time_used":331,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":328,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7h43ig3a3me0uo2g29.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.210Z","timestamp":1789268707210,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7h43ig3a3me0uo2g29.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 88646\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:12:16 GMT\r\nETag: \"6846f041aca67301c136ccb535aa161b\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2131\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88646,"size_decoded":89078,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"6846f041aca67301c136ccb535aa161b","sha1":"c2227624e4b93552cefdf3829c7233e5097c5345","sha256":"58fa83ec19689e81b9c5e86ac8c5e9cb274c75d1f92df14894e4a2b21853b954","sha512":"5fee36c22d7274a7130c0784a80a00d0498ad343215db8b7283db9efdcc78b2a58be5c778a18c9a4d1df1cac213d77e09d90545f75750e286721456e29d2312c","ssdeep":"1536:+vqkKCkC/oqhcqPJa/WEQIuXVEVB+JmvZ3eyRlf9jIaI2LLyNz:+vBtDtba/GIulEVB+wzFUd","tlshash":"cb831263f49071e7aa086229f6423af59c2d437d6c68ce1c7eb002708f6d958d21313e","first_seen":"2026-06-14T20:28:34.061413Z","last_seen":"2026-09-13T03:05:55.711619Z","times_seen":37,"resource_available":false,"data":null}},"time_used":943,"timings":{"blocked":909,"dns":0,"connect":0,"send":0,"wait":27,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameBrandList","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.355Z","timestamp":1789268707355,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/gameBrandList HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: bdbfaf1269c2d418ebc63c295a7db1f8\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_25562-30862\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1171,"timings":{"blocked":984,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd026cfdibgs1bne59klp8ym4bkr.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.842Z","timestamp":1789268708842,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd026cfdibgs1bne59klp8ym4bkr.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 9002\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Wed, 06 May 2026 08:51:40 GMT\r\nETag: \"f7192840c06345db0436e6965283e7ac\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3247\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9002,"size_decoded":9434,"mime_type":"image/png","magic":"PNG image data, 284 x 284, 8-bit/color RGBA, non-interlaced","md5":"f7192840c06345db0436e6965283e7ac","sha1":"45e99f25543d7efca6e6ad77ba3c4ad65726ab4f","sha256":"6e82b5ba535450783f68685f9dde36262d70649ba6b0fe80d1f40422c83ac821","sha512":"4b92a2069ab0512fd903b39e495ac8ac2a4f69578eed1257fb9d78dc5e22ccc9663f3feea5960f065746fcb38fa1ffd5b76cf5f0045cfab24dfbc378fe59935a","ssdeep":"192:rS5nzTNgajm4G4FFqm1eawNvMPOdbKfn/w+HQGQsdeoHzGt1GY0lqDH:eZTNgaj9Fqm1eawlMP00n/ALsc4e18cH","tlshash":"20029ed47fda78a2d5ffe6388ec5a01a8d55c8b9223477422dc7106e6b3286109c174e","first_seen":"2026-06-14T20:28:34.288115Z","last_seen":"2026-09-13T03:05:55.71241Z","times_seen":37,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":11,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/setting.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.765Z","timestamp":1789268705765,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/setting.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-6be\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50640-6028\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1726,"size_decoded":1419,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"009803fab91522e2fce2319da9b38b81","sha1":"17b2f7bf4629a1985122e211ff897f1b6d2cb5b3","sha256":"9086147d90c365ef0f87b95fbf4f1e04e9b624ac80d8fe69cbcafb07e095579e","sha512":"f8ea6c34d6c25869cfcf4effacb6103bb70b4cb1e0ab4d831dd00fbbe571d105e1b22a75a7364e94c48013d70e8c5c18efb5e042c24b6ab73e8b035762265ce7","ssdeep":"","tlshash":"57311efa73688b1903508780a7d9c58ca72cf1a176bb00c8b74725e59e644bbb43a90a","first_seen":"2025-08-30T23:50:55.152386Z","last_seen":"2026-09-13T03:05:55.713245Z","times_seen":113,"resource_available":false,"data":null}},"time_used":479,"timings":{"blocked":300,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7hbnhkmlaw1h0b561aj.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.302Z","timestamp":1789268707302,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7hbnhkmlaw1h0b561aj.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 56599\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"71be5c34099346634dc8331c75a34453\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30818\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56599,"size_decoded":57032,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"71be5c34099346634dc8331c75a34453","sha1":"1dd5541690760de5c1dbe5e70c395034bab0b487","sha256":"3352dc09af489d65eae7201d72456cb6320e1fb653ec0cbbf66515c79eeaf81b","sha512":"0abc31e5ec2f1c3f0c8a94bcd28d5120fb520b8a99a81bf885b59febcbdc213abb28a14cc498a8119cfc6787ff773da63e94e5f2b6d0426a68300f35b7d9a3c2","ssdeep":"768:oEY/dD5c0ytKR44CJIBVUXPdG2uLKj10ZyfuCKq6XmdGF6CpQCYrLKwF1RJJBTl9:7Y/p6DwVUXPd/uOfuC7duXIJvRJJj9","tlshash":"1f43025c8eedc975505b90274431e1b0d82f92d08293fb836acfbfb4ac459287527be5","first_seen":"2025-12-11T02:11:47.2407Z","last_seen":"2026-09-13T03:05:55.714439Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1165,"timings":{"blocked":1132,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index.vue_vue_type_style_index_0_lang-CRb-J9Dl.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.411Z","timestamp":1789268704411,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index.vue_vue_type_style_index_0_lang-CRb-J9Dl.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-2d19\"\r\nExpires: Sun, 13 Sep 2026 15:05:05 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04koU196_50640-6019\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11545,"size_decoded":5119,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (11494)","md5":"7aa9ad50da5f062aed4b7b3faa51d8a1","sha1":"d7c4c19db937ed71a957b97f50790936936eaf42","sha256":"12cfba58d065c3ed76e8854ee887bb42aba7cd89ab5fb0f0f4e1dd0afdb1513f","sha512":"f8326b318bf8405a57a8e56e20c727c89793730e0b547414d02673724f55c018c0673fb118d2ccd89ad5667aabb3c13a46dc6f0d3608b4f5120abf33df2c0b63","ssdeep":"192:johPHsg1+9qJK81ndhg1JUY0gEAdJyBG3oOb8QXY+nNRdJI4eX/5A6Do:johW9j716aPyeJTxVId5RDo","tlshash":"f732f80ca071493ca4261049656d4a4a620e7fe7c29984d1f1ffae326bd2ef477e8329","first_seen":"2026-09-11T22:02:29.718033Z","last_seen":"2026-09-13T03:05:55.716035Z","times_seen":4,"resource_available":true,"data":null}},"time_used":897,"timings":{"blocked":717,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/right_taskCenter.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.787Z","timestamp":1789268705787,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/right_taskCenter.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 26752\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-6880\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_23850-31939\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26752,"size_decoded":27397,"mime_type":"image/png","magic":"PNG image data, 120 x 179, 8-bit/color RGBA, non-interlaced","md5":"edf956a5977c3c0e17b3c7d78d5cfc49","sha1":"0ff256e606fcd24e84d48d961468e3e1c610cf18","sha256":"6e853d65fa20154af5cc3aa296dedf73135c03cdb7abac91416561a6d9dc03e2","sha512":"f5e94bf1a6e78797b0f9c97ea0eee4fa425d13f2cd1a06ad1b1658059ce4ed9892d26f7d3c9378d7092ebae98620ae98da3518ef662aa98a239f0fd1348d5992","ssdeep":"768:HQKD2kni6eaoyTm7Qi3k7mYjkh7iYhVS4VzRAhHjq1:HHD2kniyNi3mmYqiozMC","tlshash":"26c2e15e62366d11881a707bc5662ade2f9c7fd8981d74a37ea12706bb5c0f32309f18","first_seen":"2026-06-14T19:10:33.463593Z","last_seen":"2026-09-13T03:05:55.717206Z","times_seen":69,"resource_available":false,"data":null}},"time_used":1439,"timings":{"blocked":1252,"dns":0,"connect":0,"send":0,"wait":186,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:19.678Z","timestamp":1789268719678,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:19 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612ef_PS-AMS-04DYH56_28018-9987\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":441,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":238,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/MarqueeText.common-9LvoYRLZ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.408Z","timestamp":1789268704408,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/MarqueeText.common-9LvoYRLZ.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-6b95\"\r\nExpires: Sun, 13 Sep 2026 15:05:05 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23238-37979\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27541,"size_decoded":11851,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (25903)","md5":"4e0f1f09aff3d323e36884762b516239","sha1":"a76fb315b716b15a91e38597cc76aaefb09f4189","sha256":"2d68d2caf842803c0e8337ff344e862ed18f43382e502525852779b708043dce","sha512":"585eb2f8973742c59c7533bacd2f769047ca7a1af91381e312b3b5fb9ef4cd084ff99b0996fab22fdd80b30643ad32f7c763321d6c797e1241e98c7ffc444574","ssdeep":"384:rLZ7w0doJZcOYTicwYqBFzxB/2n7aJnRN2wyF4HlckQc+dS3H29X7a3:1EZctOcElBe+M0cMf2F7a3","tlshash":"4cc2c69975c0b87543e360ec112fa08ab1f60a54b4aeb8d0f357c5d46ef898d6127f2e","first_seen":"2026-09-11T22:02:29.452544Z","last_seen":"2026-09-13T03:05:55.718199Z","times_seen":4,"resource_available":true,"data":null}},"time_used":768,"timings":{"blocked":590,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqglxeothjgokgqr2ns.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.849Z","timestamp":1789268708849,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqglxeothjgokgqr2ns.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 12732\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"af3b0ddbaa98c70580359ac148ed1c44\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6981\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12732,"size_decoded":13164,"mime_type":"image/png","magic":"PNG image data, 392 x 182, 8-bit colormap, non-interlaced","md5":"af3b0ddbaa98c70580359ac148ed1c44","sha1":"7612059391b4f5880af62741a7fdcaffc13da8da","sha256":"bd56f5da778f387e209bb3447a8795cfa47546304d1c6bf7a3dea976fadd8fcc","sha512":"39f47d4c4f84465f3a8d3ed0ce886a6a79daba2dd76cf76e046dfef4101b6ae11d439ef397d90b861b09f8a94fe8bbee3f66f0ec9af210bf43fabff863d5f0f8","ssdeep":"384:OorVbX5nKdEGbL4R4qmZ/tFCVhMCQN6SUYnW:B5nKQRotCVib6SJnW","tlshash":"de42c0d754ac6cfdd7d4e7b2c65922346d9ae31ad59134854f102200ae924f8ebcf117","first_seen":"2026-06-14T14:24:21.584919Z","last_seen":"2026-09-13T03:05:55.71917Z","times_seen":43,"resource_available":false,"data":null}},"time_used":99,"timings":{"blocked":71,"dns":0,"connect":0,"send":0,"wait":27,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/user/pixelInfo?agentCode=sxkngs","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.420Z","timestamp":1789268704420,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/user/pixelInfo?agentCode=sxkngs HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: fdbde55468c2d418e6a6b35c2b2aff18\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:35 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04uki195_2046-65471\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":992,"timings":{"blocked":438,"dns":0,"connect":26,"send":0,"wait":500,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/statistical","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.342Z","timestamp":1789268707342,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /v1/match/statistical HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 34\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":34,"data":"{\"languageType\":\"CMN\",\"isPC\":true}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nContent-Length: 1961\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: 47e26f4bdb17c3d25\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_32057-10413\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10306,"size_decoded":2461,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"3f555db14e7fd7926b1ca3d492ff3ff3","sha1":"4401efda3bc6826554d723a0ec7d4c6cbae5ed03","sha256":"8cb48c35ef1650e93a1c2d72ccbf1d11c591f1be15596dd9d182dad052c8d74b","sha512":"554aab073680172d4c97f0635b7898a737c140b3a1c3f978909d87416c623ee86b7b7d8b68e22d94be1dac7f516fae4d31f94af02ae001d095e696629b0eac68","ssdeep":"192:76eaDazh0MP+WxqcKgFLHX0sS0EEwHIFdGmerLJ6:76eaDazhfP+WQcKgFLHX0sS0aoF2V6","tlshash":"d222a199dd4c516fba149ed420a3b8fed5e7190fffc8ebc1829c6e1d6848ba03586250","first_seen":"2026-09-13T03:05:55.720102Z","last_seen":"2026-09-13T03:05:55.720102Z","times_seen":1,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/visitor/homePageMenu?lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.794Z","timestamp":1789268705794,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"GET /uapi/visitor/homePageMenu?lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268705\r\nx-cq-sign: 99bd6faf17d34ebc50538867e848d1b649b8211baa51b87eceb930dca1c57ad280ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nCache-Control: public, max-age=5, s-maxage=5, stale-while-revalidate=5\r\nCdn-Cache-Control: public, s-maxage=5, stale-while-revalidate=5\r\nTrace-Id: e4fb9b9068c2d41856c63c29eb614f0b\r\nX-Cache-Key: /uapi/visitor/homePageMenu:8c82e67b20935a56608eff02d7e128a5912ceb9d\r\nX-Backend-Time: -\r\nX-Cache-Status: MISS\r\nx-via: 1.1 PS-CDG-04VRO197:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_25562-30847\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11780,"size_decoded":12718,"mime_type":"application/json","magic":"JSON text data","md5":"f695aa7431996b6519191aa6ba7443d6","sha1":"ea459e4f51eefb7045816a2ff904e832efb5a9d9","sha256":"9acee3244f436477db4daf2b2dc345a1140fd468de4f6d3dc8616a41946c1979","sha512":"f7a774c7109fccd786aaa0a9221954bea16050064a13abd590e8e82baf32015b76cb57dc1d03737cabc6ee3a9b6865c4965d165697bc8127dfa82fd2f31bf656","ssdeep":"192:PIoJlg1sJL1+vL/mklQvJ6vIQTuEUIE/J9vyBsZ4SwBgIFnrkKDpSk3FGMax4Ijc:fA0b0I1dLgas1jVrqoRP","tlshash":"1e3226f761481c5d1f269bc34dd77b0ca48b44c7eaec54c6ee8aea1e82352d09c1bd26","first_seen":"2026-08-22T11:58:56.659145Z","last_seen":"2026-09-13T03:05:55.723Z","times_seen":12,"resource_available":false,"data":null}},"time_used":224,"timings":{"blocked":30,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00015.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.354Z","timestamp":1789268704354,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00015.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 29662\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-73de\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23850-31927\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29662,"size_decoded":30307,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"828c32f3a682528cdaa38971b62b2d22","sha1":"2fd5412047e24f503b2b5e9b41f93cc050d5b576","sha256":"ca6b29745c40826f81abeec0d55a4fa55075d83fe0b04c26150ea55103547047","sha512":"c856bc72a6e6a7950dc99399d06d43c1824eb9e5565a34ca5ba616db9de3691998a976f0b22cc3c41913c29169784c02262f2e427a7b14bd66520e29a9278a55","ssdeep":"768:KmIi+YeqrLMZlCeA6TntJP2BNl9sVwtpc5:81Yb8ZgPItsuVB","tlshash":"c1d2f2d82bfdd179e6d916f9039559babcb0c50c25a385912049eec37aef0fa029700b","first_seen":"2025-03-14T20:40:58.53328Z","last_seen":"2026-09-13T03:05:55.72389Z","times_seen":116,"resource_available":false,"data":null}},"time_used":1340,"timings":{"blocked":1153,"dns":0,"connect":0,"send":0,"wait":186,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameSubHotList?lang=zh-CN\u0026currency=CNY","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.805Z","timestamp":1789268705805,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"GET /uapi/game/gameSubHotList?lang=zh-CN\u0026currency=CNY HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268705\r\nx-cq-sign: 37ce660cc2543f05141bb3dac65da005aee6cec2c08083e22597586c6f4f5c8e80ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nCache-Control: public, max-age=5, s-maxage=5, stale-while-revalidate=5\r\nCdn-Cache-Control: public, s-maxage=5, stale-while-revalidate=5\r\nTrace-Id: ae9f558268c2d4183fc63c299a045700\r\nX-Cache-Key: /uapi/game/gameSubHotList:6a4eae6f1a058f0e9c6740b7e17b93b1d7b820ab\r\nX-Backend-Time: -\r\nX-Cache-Status: MISS\r\nx-via: 1.1 PS-CDG-04VRO197:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_29158-31956\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40875,"size_decoded":41812,"mime_type":"application/json","magic":"JSON text data","md5":"d923a210179a39360cac86dc2482f085","sha1":"f25d6da7e08fbf5fe050f4e255ed1a6a40e65f0f","sha256":"b6adb375007be50753aeb438b8247d906039f15d7f3c90fdf2b118ca9f7ed6f3","sha512":"76fd2a8ebcc235e206187e9a916c06cb8e2c692e0eb539caccb66d32251e0ad96d726533c9df55df1474dd41a2bcc63c26304ba6267361855548b01660ed4ce4","ssdeep":"384:jW1CEHlGgwgSD6KYv/UdMwaTMxgJk8YNyp+EaQMxl7hKGzeV84DZ9TlngMb6N+p3:3YH4MHAkb7EZOcymxQtKI7p","tlshash":"980367af1d89247e5a2387ee2dbbb5cf61c520675ddebd42c22cce0194e35a16373412","first_seen":"2026-09-13T03:05:55.724729Z","last_seen":"2026-09-13T03:05:55.724729Z","times_seen":1,"resource_available":false,"data":null}},"time_used":579,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":575,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00002.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.334Z","timestamp":1789268704334,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00002.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 32875\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-806b\"\r\nExpires: Tue, 13 Oct 2026 03:05:04 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04h2Q194_44919-40705\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32875,"size_decoded":33520,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"dcb781a6c522f54d398b37c63dc49acc","sha1":"bfbca538e6eaa0e8ae39214a0b678bfd49590fa5","sha256":"91d42ee91a43d62cdb58d19aa4900fe505edef0586d1a1192db423453fa8a274","sha512":"25e6fc5fc0b890c245cdaf04389b90a04d7dffe223c9ddb105932f1b4a189d52e17839bbb572c1fed2c809a0139045c141582355538b7751ffbfc1df4875f77d","ssdeep":"768:R7tRJkfD5Bk7s9TN2NxszrqdMnnRHXLOSMfoCbE+:RpRgw7iRasXq6nRHXLOSMffbz","tlshash":"20e2f18571c3165ddaae17bfaa3ce6c6bd8b6ceece20f501e053dc12408ea8d5023295","first_seen":"2025-03-14T20:40:58.57377Z","last_seen":"2026-09-13T03:05:55.727403Z","times_seen":127,"resource_available":false,"data":null}},"time_used":817,"timings":{"blocked":-1,"dns":0,"connect":26,"send":0,"wait":791,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/menu_right.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.771Z","timestamp":1789268705771,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/menu_right.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 485\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-1e5\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23850-31930\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":485,"size_decoded":1131,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"cd18becbf3d34e5c89347da583608619","sha1":"9ab952b32568f3055bb313f882cf5d7dcd3d170a","sha256":"095c6c18960eee41813924a23f667aad68ad5a784cf2ef4be883c918993b6aa1","sha512":"3f53ac1b0d50bcf7ab3e9f2e79e09919bbe4dd46a35296859db8707f04aed8d26e979ad9c53a9d43dc30589e2db8b592e25993e94ad78a9431447bce91ea3bde","ssdeep":"","tlshash":"4bf0d4f1767c4e0b405116818ee7ee88182df34b926e01ddb34a1873ad108bf398d15d","first_seen":"2025-08-30T23:50:55.186499Z","last_seen":"2026-09-13T03:05:55.728387Z","times_seen":113,"resource_available":false,"data":null}},"time_used":514,"timings":{"blocked":328,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.429Z","timestamp":1789268707429,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e4_PS-AMS-04DYH56_32057-10422\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":442,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1317,"timings":{"blocked":1076,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/DIN2014-Bold-DH4FVQA1.ttf","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.755Z","timestamp":1789268705755,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/DIN2014-Bold-DH4FVQA1.ttf HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/assets/style-BAEGjb_c.css\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: font/ttf\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-25e9c\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04koU196_50640-6027\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":155292,"size_decoded":71187,"mime_type":"font/ttf","magic":"TrueType Font data, 18 tables, 1st \"FFTM\", 24 names, Macintosh","md5":"5f2a62e946e7bb3c9de978a33ea9ecc4","sha1":"59dde3dff369020233e2ad9fa9404ef93281f146","sha256":"5b0b2102db0b5d1492b809f6b7cf7cc2cb0d73c0ae715359fd104d937849041d","sha512":"b3183c6fed38bcdd62083dae37e1d174da299978432408de8285f9a05711fe5c99afa184f0ed3b34c2892ea9c157ab3d5db23504ea036ed1cd93f4d83b5b8e2a","ssdeep":"3072:OTEaoYZcHTI/T8ZNeUoRZfeNYJ9CBwaU7icsVcA+e8JfxkJplrH5:OTP3FuenHWNYTCSa+icsV/+e+xkJplrZ","tlshash":"22e32b92f28a775dcf531c7a84618298cde2c93fedd90bb7be762c9745050b88c52d88","first_seen":"2025-03-14T20:40:58.462661Z","last_seen":"2026-09-13T03:05:55.72929Z","times_seen":117,"resource_available":false,"data":null}},"time_used":309,"timings":{"blocked":116,"dns":0,"connect":0,"send":0,"wait":181,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd0b72xdj4b6l2bkkmzfxs5ylv6v.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.175Z","timestamp":1789268707175,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd0b72xdj4b6l2bkkmzfxs5ylv6v.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 36219\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Tue, 09 Jun 2026 06:36:02 GMT\r\nETag: \"efd4993c25f1e3290d8a6cc64195fef7\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3224\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36219,"size_decoded":36653,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"efd4993c25f1e3290d8a6cc64195fef7","sha1":"1af0a30436f4c7f32f940cb1004455c743c3eae3","sha256":"50e490ec50e0b3083048d1bc095aa738760cfc975ecd29d8a65f3757f5c4a8d6","sha512":"acf9997f987993c00226d72bace9bda0b8075271ecde1607047ac5be8d9865d26424fe553252587c586a37ee0064c38d876fe01c3bc29f49368008b17b8b5931","ssdeep":"768:0Rf8dqvBDCGVQdPe6TiLCKnQvPH/t2QhvzUTdnyE:GpDBVEFGmoTu4T0E","tlshash":"fdf2f2b2290d85e2f58985f5ea975cd7d793c1992d84323bb1bc2814337e9b40e22b1b","first_seen":"2026-06-14T20:28:34.060254Z","last_seen":"2026-09-13T03:05:55.730259Z","times_seen":37,"resource_available":false,"data":null}},"time_used":891,"timings":{"blocked":855,"dns":0,"connect":0,"send":0,"wait":34,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzlxs7cfrw7g20uhrccl.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.190Z","timestamp":1789268707190,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzlxs7cfrw7g20uhrccl.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 73962\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:27 GMT\r\nETag: \"61ba22768ba41f274b1156cdc58405cd\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33016\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":73962,"size_decoded":74395,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"61ba22768ba41f274b1156cdc58405cd","sha1":"ca9ef34fea4e4847519639624aabb752f9292cc7","sha256":"783fc1a2f6614977ffce0854413e25dd519fc2ac1016265a6102f63bb10d932f","sha512":"b160259ff46a7ca439c0cf95bb5428034defc7c77bf648b859f3c8b58d3aaba8301962b2122d472f46a80af06ec05d6e373b326dfac1fde72e24dab1bc35d87a","ssdeep":"1536:kkaOEDi7nyyBfIt8CU9AX8FTHfE5yFLW9v7UJPmb:MB6nNSDOW8FDfEQFLigJub","tlshash":"b97302af93e60ded67514400cc3e64c1eca42f98095fb2652e35df407e4a44b7aacbc8","first_seen":"2025-12-11T02:11:47.177699Z","last_seen":"2026-09-13T03:05:55.7312Z","times_seen":42,"resource_available":false,"data":null}},"time_used":920,"timings":{"blocked":870,"dns":0,"connect":0,"send":0,"wait":38,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01kmad66yhcsk9fhz2it9xldzm.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.882Z","timestamp":1789268708882,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01kmad66yhcsk9fhz2it9xldzm.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 1584\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:07 GMT\r\nETag: \"a59ce4343c5718c0640db0f727766c61\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3250\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1584,"size_decoded":2016,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"a59ce4343c5718c0640db0f727766c61","sha1":"9f444b57f6e1353c3525051393085fb231bc63b0","sha256":"d69fbd2d98a654888136cc3bb43f16a77533afa8c4489aedd8285fe23f48c925","sha512":"239f5542e2fcc7f9f26fff91e3cff0964a47a71779836f5b82143948863555c0e5dc0fccdd220c6363975422700239bcf9db2f744388dcead4aa1d7a162b3721","ssdeep":"","tlshash":"df31e7defac6c38ce209581aa77341388d3732ed37a0e57645111928231b143823beab","first_seen":"2026-06-02T06:09:34.287826Z","last_seen":"2026-09-13T03:05:55.732165Z","times_seen":45,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":96,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/weekleaderboard/config","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.799Z","timestamp":1789268705799,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"POST /uapi/weekleaderboard/config HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268705\r\nx-cq-sign: 3082e116979a649800e3b7aa839c8f5734421c400f01b08722a7cf627c30b40280ffb1e19b5c\r\nContent-Length: 2\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":2,"data":"{}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 044d8c9768c2d41850a7b35cc0719d96\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_56153-3215\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":976,"size_decoded":1672,"mime_type":"application/json","magic":"JSON text data","md5":"a3a968387909a8f7b33b1549e8756c3f","sha1":"7a0cd3e408b63f5c31ba19bba33ffd61e298ee32","sha256":"e085a7d795a62926255893879a84a97f39ee9064438dbda638b68f286c907aa9","sha512":"48107727de1b1dd4130d701cc270a9cd3f5018ab8f0d7d2c6a47a04a3520efcd174dd047d60f1d3873840fecda58dbbb19892a3a0c356f1a34e07d8c30b66867","ssdeep":"","tlshash":"c511c29219994350c6453ed5c357ed9da2adb12ad9e1f695dc99cc2002e0a96c11bc10","first_seen":"2026-08-07T21:06:08.030148Z","last_seen":"2026-09-13T03:05:55.733163Z","times_seen":33,"resource_available":false,"data":null}},"time_used":300,"timings":{"blocked":111,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9t7mlm8phlhg01z0xs8.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.236Z","timestamp":1789268707236,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9t7mlm8phlhg01z0xs8.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 67210\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:44 GMT\r\nETag: \"8b88a894c5ed56f6c00c177af18e9e69\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30809\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":67210,"size_decoded":67643,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"8b88a894c5ed56f6c00c177af18e9e69","sha1":"35e59567cba6c7ec8b02298dbb80f07f382da6f5","sha256":"382e6de3c733fd5f6bd656bbc8627a5efdf5f8bd80bbf02e009c81e5bf954dee","sha512":"b86c8aaacf4025785213c8bbd902ce81fa2a79bfd68b0db750f6a765672bb62e3d39840ad89e4410dce7d4e918c9d80f174d34962892e01249ef8f47237dff26","ssdeep":"1536:qN1eLErsHO7P8aoDwEZIV/+MJcotRvB/39Nm94wGwwiI2YJ:qN14isuL9UIV/+4ZB/9NmOdD2I","tlshash":"c16302c5252de5a3841e41286fd4fe4dfe505dc2ba788a6791fa5c4b8b73c48d0232f9","first_seen":"2026-06-14T20:28:34.316381Z","last_seen":"2026-09-13T03:05:55.734324Z","times_seen":37,"resource_available":false,"data":null}},"time_used":985,"timings":{"blocked":951,"dns":0,"connect":0,"send":0,"wait":27,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameSubList?categoryId=3\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.357Z","timestamp":1789268707357,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/gameSubList?categoryId=3\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: d9ae721469c2d418d9a7b35c0192db51\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3234\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1201,"timings":{"blocked":1021,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/service.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.764Z","timestamp":1789268705764,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/service.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-5dd\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_46621-35453\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1501,"size_decoded":1295,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4fee9dd00973c5da76887514f7d3900c","sha1":"856ce8cf4cf12939fd87c6aea8a28e2101139047","sha256":"e72dfe495f2a034bd30611446f0529c20c0dd8805affe0854ba738d1ed873c1f","sha512":"38fb5c5ffe760d2b3e269be77e3a15db1aec31f70fcdc7bd162668942cfd1b0af3fa9a16711d772cc4cab994662a84a69ede6bd9daf1daffb8b5631a7a2e3e9a","ssdeep":"","tlshash":"6431c0b15bba8ddc511a43c4dbe8d5482f3de2e7b23150a8f34819795f204a7297f90a","first_seen":"2025-08-30T23:50:55.227125Z","last_seen":"2026-09-13T03:05:55.735404Z","times_seen":114,"resource_available":false,"data":null}},"time_used":474,"timings":{"blocked":296,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkv6nyuni94x0sbnc80.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.256Z","timestamp":1789268707256,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkv6nyuni94x0sbnc80.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 60139\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"802b9103417ff984cd495d1e1bfde6fc\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33025\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":60139,"size_decoded":60573,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"802b9103417ff984cd495d1e1bfde6fc","sha1":"1e7607838642f36345cf612ef1d60b1ef6ccf3c2","sha256":"0fdaff085c270f3568e26898dc578d14031f8120e39099519b514a3674903754","sha512":"6c22dd4772c7c0855231c7fc017ca545304cea9d5b659b31d8baff261a5d29003f67fd5727a7fae2c6c10844f9a520a7185f538816db9792dee0348fd74cb37a","ssdeep":"1536:gwYy6QDAaxjn77hmXwfAuWrot/iZEr1m+F2E1v2q:gvyZDRhnBiuWC/trUMlv2q","tlshash":"9e43e054330be78bfa22c17296824955dd21dc66b2e2cd1e0a734794f9f8c6c7391d4a","first_seen":"2025-12-11T02:11:47.089574Z","last_seen":"2026-09-13T03:05:55.736448Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1052,"timings":{"blocked":1019,"dns":0,"connect":0,"send":0,"wait":28,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkwbcq98o956069sx9t.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.267Z","timestamp":1789268707267,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkwbcq98o956069sx9t.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 35780\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"a02ce26c811a9350f0d3eaa9f786bc54\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3232\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35780,"size_decoded":36214,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"a02ce26c811a9350f0d3eaa9f786bc54","sha1":"140c61ef9e2aff3b4b4e981418f9484947fddb94","sha256":"9c33f86179a442a2d3f833c0cb2b57802324dac08d7cf05474aee52586695394","sha512":"9a3b51a93694da609f0ed240e8def150a79e9f6730d2e9ac4ed7de0b89230c5024c0b4a716f817ea95ee388a4d365cdd14ee38217c75b45547c9623a2dcd7d60","ssdeep":"768:fu5j91PsNIZqxOeLvK7IGFZ276cDIm4Yqc1:f8j96+gOuviXZ2L0sqc1","tlshash":"22f2e035a2a7f726d39af3f29c4e81d6f80e296d0cd588d8d0e1495f90358e5227a1cb","first_seen":"2025-12-11T02:11:47.139838Z","last_seen":"2026-09-13T03:05:55.737663Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1077,"timings":{"blocked":1047,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlt928ywvedy0mu0a0c.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.324Z","timestamp":1789268707324,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlt928ywvedy0mu0a0c.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 70863\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:54 GMT\r\nETag: \"47f899397a9a4a2c447f30076a9e8eba\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6974\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":70863,"size_decoded":71295,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"47f899397a9a4a2c447f30076a9e8eba","sha1":"907bcd4d93ba934a34a0df0418de141055b66baa","sha256":"19404d4c9f515113baf8a8e59a1d0a8dc2b34d104bdfde707bdb4729d1854db3","sha512":"c860b87a30a8d7fd44e69f529bce54711c31e770128193d14ade145235bca8e49ee2077bc51c69822becc648a2418ad8806882668e219d19c9bdc504c161bc5f","ssdeep":"1536:mlDzGwgfv6zxl14LBw5SmbgoKv79FlmgnK9vfR30ANZ:ml24zxl14LBw5pIQhkm","tlshash":"b96312d8062293be93fc8b949f35dd4b17da29fba2d2564521bd202fd307319c53c2a6","first_seen":"2025-12-11T02:11:47.348791Z","last_seen":"2026-09-13T03:05:55.738611Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1250,"timings":{"blocked":1218,"dns":0,"connect":0,"send":0,"wait":27,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/sys/appVersion?platform=1","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.800Z","timestamp":1789268705800,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"GET /uapi/sys/appVersion?platform=1 HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268705\r\nx-cq-sign: 995cc9519b36854f9742e70c303433abd5f896a9db7a9f9e93132600bc39601e80ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: b296329868c2d41852a7b35cf92f3a89\r\nX-Backend-Time: -\r\nX-Cache-Status: MISS\r\nx-via: 1.1 PS-CDG-04uki195:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_55446-4889\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":286,"size_decoded":1004,"mime_type":"application/json","magic":"JSON text data","md5":"37fef2d58e250fe62bd0fb2ea00cce1f","sha1":"834acf4a851ae615e104f66bb898732c6190585c","sha256":"1c285cb0008d2881b676c3998f8071f09c4b27a769b1894b4ea98c8df987072e","sha512":"912fb72e5888a6441f4b61fa0516c19fd6a579106eba97f8dd75b4b159932b6a5f7b077cb69fc581fe45b6e5b6d23bda2dd4fa9024a2a0eab85c238b7b4f7064","ssdeep":"","tlshash":"36d02b735a9898ab03005ae970be6000c113418afcdc3061df99580ac5f64e06f09911","first_seen":"2026-08-07T21:06:08.010716Z","last_seen":"2026-09-13T03:05:55.739521Z","times_seen":29,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":8,"dns":0,"connect":0,"send":0,"wait":190,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/channel/g9kdwd056cidioqymt3w67wmhdaw1g1h.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.168Z","timestamp":1789268707168,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/channel/g9kdwd056cidioqymt3w67wmhdaw1g1h.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 344248\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Thu, 21 May 2026 23:35:13 GMT\r\nETag: \"bc2c1345a8dd72d4178e423e6e86f198\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_22838-33015\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":344248,"size_decoded":344683,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 2400x500, components 3","md5":"bc2c1345a8dd72d4178e423e6e86f198","sha1":"7017fdceac33619efb4469e364b286d4720ab1bf","sha256":"88b347719e107370c247a5dad2f66bed7700b88ce31033c6dd81765df43f52cb","sha512":"f46ec1d4ec0906f5e2a2e5a5a0b14a7c848205f0c8f91d26cb01c4f37216bc9c959f50ae78dd0f26e16771fc95240d5a2fc66c6d7f07a9db2fa7f2f688eb6027","ssdeep":"6144:cFHlnqclNoV0/wfCcPFEDVCQQ8X8M0Tit8aISnLt/aLEEzFt9/4GpqRUSI:cFHlnqaoKUNAjQ8+DIuEEv9/4WUW","tlshash":"2574120957075cbb4ace30539cd96029e807ffbcf9ca1d6d86d7b434ea42b5a48889f1","first_seen":"2026-06-14T20:28:34.202948Z","last_seen":"2026-09-13T03:05:55.740381Z","times_seen":37,"resource_available":false,"data":null}},"time_used":934,"timings":{"blocked":-1,"dns":747,"connect":27,"send":0,"wait":27,"receive":98,"ssl":30},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1bwndeckbhag5qyt690vk06q6.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.292Z","timestamp":1789268707292,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1bwndeckbhag5qyt690vk06q6.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 33637\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:15 GMT\r\nETag: \"c15ab406efa17c5ab9668c7f3463b94d\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30817\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33637,"size_decoded":34071,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"c15ab406efa17c5ab9668c7f3463b94d","sha1":"0dcb310ccd0592ae2a891d680013ffa534a71c4d","sha256":"53b251559c7e7b6243101cdf0493484f7ead1e156557fa6520b0e8e1fda0b376","sha512":"d76df812e6d4df16fdb9b3294431c0d26dc68cbd658ea3522fe4b8ca80a8198588b17fa6a6fbbac040f6cfe5d957eea4ff11e29dbd8d2274e20f476d30bbb87f","ssdeep":"768:EeJt3T1+hSb2hYia4zIdTE+KNEqNkeFkRRmGXnyLT82yP3EJ:EWtDYhSya4MRINFNrFkXtyLMPY","tlshash":"77e2d12343c492affd9fc5b152de0ba11e6a8c390854afa6459618c12776f5f24f0bec","first_seen":"2025-12-11T02:11:47.30365Z","last_seen":"2026-09-13T03:05:55.741173Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1133,"timings":{"blocked":1103,"dns":0,"connect":0,"send":0,"wait":27,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqg2oxszolezlqy1dz2.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.848Z","timestamp":1789268708848,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqg2oxszolezlqy1dz2.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 4846\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"716720fd3228ce79ddace4610da8002d\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6980\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4846,"size_decoded":5277,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"716720fd3228ce79ddace4610da8002d","sha1":"360bbab15a893eeac2f5b40ce9f0f37267186888","sha256":"abaefe1baa91a7c4cfd5e30ef363ce90a60f0d562db1ee07e6cd1c954297560e","sha512":"44c9b3c9cec97656b18d922a17eeafe8be087ad0bec9acd75f104a861a600bfc04ab7397bc971d5080fd5f368758b3355e728c73fdd3fa6d4b021407d32daaa7","ssdeep":"96:tX+tg86VOp0Cqudq++zxuh14ugEtG/w0fqeuYghxlngNV:tXKg861uk+GOAZzK0","tlshash":"c7a18ebc2ac0cd6ec2eb9031708c2a629e13e8bd235c4bb07a54c4cea00d5b4c890ad7","first_seen":"2026-06-14T14:24:21.289095Z","last_seen":"2026-09-13T03:05:55.742174Z","times_seen":43,"resource_available":false,"data":null}},"time_used":72,"timings":{"blocked":44,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un289ede78n02tvzrldg0mdsxkp.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.296Z","timestamp":1789268707296,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un289ede78n02tvzrldg0mdsxkp.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 56405\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"37fa6d6c5692cae3fab81e1699c78d9d\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7786\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":56405,"size_decoded":56838,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"37fa6d6c5692cae3fab81e1699c78d9d","sha1":"2a7694ef00dbeb5a81f7cc8b6ef87d0c91ec9dfe","sha256":"721c4864c8ca891f8bfb16dcb2cebebcff31bcd1b842f17081513481063ccf41","sha512":"d92dbf62339fce54824b93d4118c5826549b43d1cf8c8b66cf88f6447499d6ad17679c7087b22f0d9f99551f6dbf6a75ebf3f8e9b4b1c204ef505ae2a533ba1d","ssdeep":"1536:KzdS9/LSG8cp6lm9tyT2lLHPTBv18P0RUC6H8A:Kixvp6UaTcLHP/ZRYHr","tlshash":"8443021f5506c315f3412ba7b970670f81a821af7b36490a71a1832c8fdc9d555b93fa","first_seen":"2025-12-11T02:11:47.06921Z","last_seen":"2026-09-13T03:05:55.743033Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1158,"timings":{"blocked":1125,"dns":0,"connect":0,"send":0,"wait":28,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/agent/supportActivity/generalEntry","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.806Z","timestamp":1789268705806,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/agent/supportActivity/generalEntry HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: c95fdc7668c2d4182bc63c29b731115f\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04uki195_56153-3211\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9t8626ardghp0gm7xfz.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.224Z","timestamp":1789268707224,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9t8626ardghp0gm7xfz.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 82651\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:44 GMT\r\nETag: \"448f8d3a5ad5a66951a7827cef3f20fc\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6960\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":82651,"size_decoded":83083,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"448f8d3a5ad5a66951a7827cef3f20fc","sha1":"735212b54155f8b1a258981af6e584183c247bde","sha256":"322cc2553734bde4e98ed970af996fd4ba2fc7e499f7005ed252e7e1bc347ce8","sha512":"877a84be8bc1022c86cea4fdc2ba7479e7b717dfe18fd3643ad1127b0e3acb692f40c4c524f23b309e1cae883c20655d4e43954ea4ca2c2521aceef0ed271c78","ssdeep":"1536:TDkrd6wS2+vpLdtTim4Exyg6YE80AtVprTNmUSNGXrTjH9tPRBas:Tyz0NimzxoYE8nTNmUSNIrTjdtis","tlshash":"54830212213989e3b1673e34e2b1c8d02367f236b57ad78a9717d3de768b5c68601378","first_seen":"2026-06-14T20:28:34.204352Z","last_seen":"2026-09-13T03:05:55.743858Z","times_seen":37,"resource_available":false,"data":null}},"time_used":961,"timings":{"blocked":927,"dns":0,"connect":0,"send":0,"wait":28,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un4adjdee7ok3necf010ekjfi0x.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.305Z","timestamp":1789268707305,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un4adjdee7ok3necf010ekjfi0x.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 26477\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:55 GMT\r\nETag: \"adb3264856aa7bb72511c4912c170013\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3237\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26477,"size_decoded":26911,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"adb3264856aa7bb72511c4912c170013","sha1":"c82d578a2280a42eff3a0d544b0d3f8660403572","sha256":"a21efc48c4874449ed71223f3975dd1128666b324e3e0ba3f7aedbab3eb558fc","sha512":"b5a42c9d51d8d6517a8664b5ac0df5bce799143b97cd6fa8330334f37aca97a3a73a1a05c4918081f9f45fd608a98373cd99f56e358ea2dc47575eb04ac94261","ssdeep":"384:xjiFhPdBqpcCqW68xDeOCii02CHw71SYOvlBXzXXwzQdjtNKQBL0K0A96bNX8srU:cPBFs6V5iOi7YOvl1TqojtNFLV6b7U","tlshash":"9ec2f1e984d1aee3ea3bf33dc9af454d2b01db70c3169a7599211050e7e5b9325c236c","first_seen":"2025-12-11T02:11:47.276917Z","last_seen":"2026-09-13T03:05:55.744704Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1186,"timings":{"blocked":1156,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055uncsifdej59ewzlr39usndvdyf0.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.286Z","timestamp":1789268707286,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055uncsifdej59ewzlr39usndvdyf0.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 22631\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:58 GMT\r\nETag: \"3658f7430139a7f6beecb01bc2dfac53\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33028\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":22631,"size_decoded":23065,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"3658f7430139a7f6beecb01bc2dfac53","sha1":"d835b267805dfbc6f832ef5dc52cde0a484dc6c0","sha256":"c02de2dcf2ac3a8926c620f0d2ff8acbbbdfcee2df2480c09b941c3181305a2e","sha512":"5fae7c208250ae6464fafcc8049eadd264dc1ce5d9d2f37c6c9005018817e92946182cf9a7c61cd5dc60b256cd407fe66debb4bc6c356d03965e25d382f28bc9","ssdeep":"384:VXvrjyjkSpcvXW2humjldOOOVC22UElCbNM96ZH0AHUsj3Q7WkwL1CHuD5DMAAE5:VXv6jkqcvNljXOOAC9UEmNM9n43Q71sr","tlshash":"0ba2d1d7879e4005d3cf17f44c44413b7ac8ab7785f58be24a2beb48a31416c5a9076b","first_seen":"2025-12-11T02:11:47.347421Z","last_seen":"2026-09-13T03:05:55.745408Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1123,"timings":{"blocked":1094,"dns":0,"connect":0,"send":0,"wait":27,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1bwndeck7wpuk3bvr00a5modo.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.304Z","timestamp":1789268707304,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1bwndeck7wpuk3bvr00a5modo.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 39071\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:15 GMT\r\nETag: \"6ebb2ba481f5002fad0cde2e0e4e51b1\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33030\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":39071,"size_decoded":39505,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"6ebb2ba481f5002fad0cde2e0e4e51b1","sha1":"31d3c22b28d8a9b13c25411202697dccd51dc877","sha256":"d355145e2efc286db9683930837a723d1db1e2a6801924e9779c41368afc37a0","sha512":"58ffc51d6386309f4fc5e407b6d14814c18d1a459707bb9edc454c1ee835ccafa223c158a0081e12f063e7700aad6492aa7ce74584a58b7b671676eeac82018e","ssdeep":"768:Q093aClALhLhIbaPisojyLkw0LFpARZexY5cqSLsN55SpIUlYC:Q093aC2hYSijXwkbKkgSodUuC","tlshash":"9703f13c0f84c406d91a80751c9227a5cbad712ff54cfcdbb10eda082aa9e679cf1947","first_seen":"2025-12-11T02:11:47.29752Z","last_seen":"2026-09-13T03:05:55.746272Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1181,"timings":{"blocked":1151,"dns":0,"connect":0,"send":0,"wait":27,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-QhTG0TiH.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.451Z","timestamp":1789268707451,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-QhTG0TiH.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-11c3\"\r\nExpires: Sun, 13 Sep 2026 15:05:07 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04h2Q194_44919-40731\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4547,"size_decoded":2796,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (4546)","md5":"a6d083fde87e01ef073867973fc48e76","sha1":"22ac08a7ab429c578d5ba903c75eb1e5c5e2af17","sha256":"d143ad94cf4375911288c229865447dfeeb23ef38ef321c7891742cc17cbb05a","sha512":"fd44e4a889700ee4275129975ecc4e5a00d447706c55b01fc6e999a07188e6885a8d0518e1a200b63ba26f522469a1001666091a6fa2bc67b5449a081db031f5","ssdeep":"96:SY0V1VXWR5ya5+wn9sRzfEwiz02YHkNsHoUjH:SY0LVXWPya5+wn9ozfEwiztYHkWIUH","tlshash":"1e917308ba4934b3473b4b91942e4c1582ba43d8e8d798f2b15f8d582affe5532ce6d1","first_seen":"2026-09-11T22:02:29.37858Z","last_seen":"2026-09-13T03:05:55.747153Z","times_seen":4,"resource_available":true,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/sys/regionAccessInfo","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.417Z","timestamp":1789268704417,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/sys/regionAccessInfo HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 11a2fb5168c2d418f6c53c293a2fdc00\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_25562-30838\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":945,"timings":{"blocked":388,"dns":0,"connect":26,"send":0,"wait":502,"receive":0,"ssl":29},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/icon_backtop.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.731Z","timestamp":1789268705731,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/icon_backtop.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/assets/style-BAEGjb_c.css\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 829\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-33d\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_44919-40721\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":829,"size_decoded":1475,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e27195deac9f53b178fa6bd2d6390f8b","sha1":"663ac7071401475a8d40ce006e8da21939068d35","sha256":"57ae2d99e3d7a5d351fafc1c9d14b4ab1045bbfefa5da92c95dbd5b9d70957c8","sha512":"1705e91fce770fa6404e11fdfdd2583d2bfc6586654efb3f80226f98cb2ab90afb61f2b73fbb2082036cc6f5849f3ccdd5b666961275df102be55c859bbe225b","ssdeep":"","tlshash":"7401ab3901344bd892018b05dbc8b85d327cb297b37410a5b30234a1ae6267ba9ab289","first_seen":"2025-08-30T23:50:55.136583Z","last_seen":"2026-09-13T03:05:55.748306Z","times_seen":108,"resource_available":false,"data":null}},"time_used":898,"timings":{"blocked":719,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1m7pddvfiraxn6br410s6zz6e.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.212Z","timestamp":1789268707212,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1m7pddvfiraxn6br410s6zz6e.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 87345\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:21 GMT\r\nETag: \"b8e0c82417a032fc75499a8735dd4f4e\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33018\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":87345,"size_decoded":87778,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"b8e0c82417a032fc75499a8735dd4f4e","sha1":"3ee45fbf587b1e67aec47579ecb3780303556a46","sha256":"1362bb8473c3bb6916d21f59bdcb84b1031fb66af88994b825243db60deb61ff","sha512":"b48c69e942c0e4c9c969ad4756be9dec86f9c4e8718e2016ff82ccef002a27583ac8930b016fef69b28abd3b06ee98bd92c634f22266ec16f0636b012c88067c","ssdeep":"1536:mAJchVx3eSClfFojUq1ry8GIiXBgQ4NOVhyNlYqDv5jlqEQKh:j2tN0Wjhy8G1R5i3YqDv5oFI","tlshash":"2d83123f5e185a57dca432dc878e5ce1077386486245b029dacd2a5c393f8e0b496bbf","first_seen":"2025-12-11T02:11:47.124103Z","last_seen":"2026-09-13T03:05:55.749448Z","times_seen":41,"resource_available":false,"data":null}},"time_used":954,"timings":{"blocked":920,"dns":0,"connect":0,"send":0,"wait":27,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/recentOrderList?lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.352Z","timestamp":1789268707352,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/recentOrderList?lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: cf28721169c2d418d6a7b35cee9e8d24\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_29158-31978\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1152,"timings":{"blocked":972,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqia2engjxm5d2hjsks.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.832Z","timestamp":1789268708832,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqia2engjxm5d2hjsks.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 9976\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"cceee239722b8c902746d25c7517b31c\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6978\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9976,"size_decoded":10407,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"cceee239722b8c902746d25c7517b31c","sha1":"cad269ff1a6c671200aedba7bacf88100aa33da0","sha256":"fc13c7800fa936ffe817030462c535ed414a90c3e2ec5c31a691f3c5326dfbac","sha512":"94dbae500251bdeebebb6502dd9033224abac00dbd52b9c469aa5552b78fc083606ab3d33ef715c2ce71e0b9add78abc1866f510068a161c9cbed5841d5a72bd","ssdeep":"192:oxoYQAYpTgSDJRcHll4PSBuiYSxCNP7FFubp2iPNBhgk5GhuTK6:kgEly6w4Uz30pJFDYum6","tlshash":"3c22aecfb62d6e1f8ac61266cd53460183bcb634781412e4fbedd8a3c16ca055381ade","first_seen":"2026-06-14T14:24:21.359711Z","last_seen":"2026-09-13T03:05:55.750329Z","times_seen":43,"resource_available":false,"data":null}},"time_used":27,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqeqb2jilsawsfxh6e6.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.831Z","timestamp":1789268708831,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqeqb2jilsawsfxh6e6.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 9006\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"acab592e5627247796de6c696c426df8\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3246\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9006,"size_decoded":9438,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"acab592e5627247796de6c696c426df8","sha1":"ba0ab152d7398f4f1ad516c9e487f620536a957e","sha256":"5a6f96aa629608998c0b2e87d991f6002c18b405b007f24a6be0750010320922","sha512":"d837301fcc550d447ab329073479b189d321744338b2853fd764a8e93ba0b85b1c1e2671990fef32d267332052de1f05039a79d95e9a8884dbb97b1898704d7b","ssdeep":"192:S2wvS6VILWVLObLpR1WnKcl6VjtLFwcS6rSKCED76gTM:S7vS6WLW8v1WnKrtJwv+SKCW7c","tlshash":"f002ae2df9104ebbec19397b222c1028923838d1d6d988724f5956254717f4a5eec6ff","first_seen":"2026-06-14T14:24:21.592644Z","last_seen":"2026-09-13T03:05:55.751171Z","times_seen":43,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/sysCurrency/1m055un1eijddstl8tekfu9e5056yzqf.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.875Z","timestamp":1789268708875,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/sysCurrency/1m055un1eijddstl8tekfu9e5056yzqf.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 1096\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:20:30 GMT\r\nETag: \"29b8a41898ebf0a7f7aee6cb1a2c8b33\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33039\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1096,"size_decoded":1528,"mime_type":"image/png","magic":"PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced","md5":"29b8a41898ebf0a7f7aee6cb1a2c8b33","sha1":"04846658f67265fbbaf58a31de87fc4df4c23a28","sha256":"c9be9a03cdc0b591b3eee3d10c0e2d2c3facbc1d87f133a377f5d86016cfbc11","sha512":"179043e52339ddf3fb561ac9c3c2b31f4b01b906055547de3ef10c230e97e76137a1aec01171b10f74529aa0b0b3c57eb237f10963f75a06778ec29a2e895e77","ssdeep":"","tlshash":"2311967cf33bfd98daf5305c4b240c9c9e3d294a6908815632467d4044a309d25cf652","first_seen":"2026-06-14T20:28:34.169793Z","last_seen":"2026-09-13T03:05:55.752095Z","times_seen":37,"resource_available":false,"data":null}},"time_used":130,"timings":{"blocked":102,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01kmad66yi83avn863e9wlc0ym.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.908Z","timestamp":1789268708908,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01kmad66yi83avn863e9wlc0ym.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 1427\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:07 GMT\r\nETag: \"128ec135670500277231ebf3051a3b97\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6982\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1427,"size_decoded":1858,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"128ec135670500277231ebf3051a3b97","sha1":"0dc6e7c3d2c609354b53df6437ed0a6f0319f448","sha256":"cd44f676f8c579d838768b37df2f3471c539b14dde764e5ba3795c8d17c4cd5f","sha512":"43f336f1db87389af8b0f6fded9a4c3c9fb1bc605184c53715bf1c9b416b8f6becb09aeb98a8377200f7edcf22ae0e6ce2a933a93733ce3e4023d05304b49221","ssdeep":"","tlshash":"8221e9f562e617e8c3f72a2b82786170cc519881378907131d4fa16c65d331f1382801","first_seen":"2026-06-02T06:09:34.385936Z","last_seen":"2026-09-13T03:05:55.753398Z","times_seen":45,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":72,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.964Z","timestamp":1789268706964,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_32057-10402\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":442,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":811,"timings":{"blocked":-1,"dns":54,"connect":23,"send":0,"wait":675,"receive":0,"ssl":60},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/merchant/detail","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.965Z","timestamp":1789268706965,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"POST /v1/merchant/detail HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nContent-Length: 34\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":34,"data":"{\"languageType\":\"CMN\",\"isPC\":true}"}},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/json;charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nTRACE_ID: f74626f4bdbff74ca0\r\nContent-Encoding: gzip\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_35724-11825\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":376,"size_decoded":690,"mime_type":"application/json; charset=UTF-8","magic":"JSON text data","md5":"cf351ae6a70281206213f5f5bf2f85de","sha1":"781bb5f211f39eaac43493bdd97fe8d3d5b77ef8","sha256":"5e8424ee140b35736ad223fc8bcb979d65d8f7c59761b5ba7e79c181c4ec3ab9","sha512":"5ce339618e05e4e13a1c3eef6fbb66ec3fa84d2f398c7fcedcfdf19f0390c2147bfaec601dc2b0d65933115c35f4cee5e222b5bad5ec2a287ff8f3caae334181","ssdeep":"","tlshash":"1ce06da30b94062bdbc141cdc518a8365dfaa2973d200940a65787dd6a15e881872232","first_seen":"2026-09-13T03:05:55.754506Z","last_seen":"2026-09-13T03:05:55.754506Z","times_seen":1,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":241,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01qt0dct3eo2h8qrazigrtb0ai.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:09.211Z","timestamp":1789268709211,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01qt0dct3eo2h8qrazigrtb0ai.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 1994\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"7a33925e4417f2d5e2d4c14f88caaef2\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04uki195_56153-3254\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1994,"size_decoded":2426,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"7a33925e4417f2d5e2d4c14f88caaef2","sha1":"e261ac74ea8a2a3da2d501d6fab50c6f2d3c700a","sha256":"778f5212a3884a69299b7dfa6d0836f6f92dedcce7f4f3a8ceb295c31dc7df8a","sha512":"fef97405372d9b3d8e6ea67caa780e980aa9261ac42735247694a9cc58a640ef93a682467570f365a7d61a7393239caa0ccaafa54141ad8b9ceed14c78e12b0d","ssdeep":"","tlshash":"2a41ead7b9dbe27dd1906e7e0528b560e71c3344256808d507144a3dfd5855c4f8136a","first_seen":"2026-06-02T06:09:34.303198Z","last_seen":"2026-09-13T03:05:55.756961Z","times_seen":45,"resource_available":false,"data":null}},"time_used":29,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/language/static/list","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.959Z","timestamp":1789268706959,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /language/static/list HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_28018-9770\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":441,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":372,"timings":{"blocked":-1,"dns":59,"connect":18,"send":0,"wait":240,"receive":0,"ssl":55},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9tbpslzh2sin0xlsu2e.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.228Z","timestamp":1789268707228,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9tbpslzh2sin0xlsu2e.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 77413\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:45 GMT\r\nETag: \"a80d4a212483f3ef826396201b418af5\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2134\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":77413,"size_decoded":77845,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"a80d4a212483f3ef826396201b418af5","sha1":"703828536b56520dca528eac5bee6c6be037a473","sha256":"9737c45360d8f167bad33281c75a34160dc8abb5d2a6557eeddb88ba212ab97f","sha512":"5b40b03eb6e5cb4ec2d364461ed7d41fadffbe442a5eeb6e22aac7c63cc37d860d95c1d55705884749d7c3524cbc08c996491687adb6600a423f7ba223061230","ssdeep":"1536:EMhrqgWbtJNVf7KWvO9SZDIk+gHfUqjxEoKcButj0YNeNdKmwgYBAoF:EurRWbtJNVTPG9oFEqUPNeNs3gmF","tlshash":"b77312a957ad8f137fbe4b99d0b0e94c248bfd07b8115d402031975bbe18b0f866ab31","first_seen":"2026-06-14T20:28:34.054181Z","last_seen":"2026-09-13T03:05:55.757894Z","times_seen":37,"resource_available":false,"data":null}},"time_used":977,"timings":{"blocked":943,"dns":0,"connect":0,"send":0,"wait":28,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzktkxn32ik4k0pjl5nt.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.260Z","timestamp":1789268707260,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzktkxn32ik4k0pjl5nt.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 36823\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"30828ed3825b9bb3bb9f30f418d2c7f4\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30814\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36823,"size_decoded":37257,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"30828ed3825b9bb3bb9f30f418d2c7f4","sha1":"645d4c9a02fb2aaaf0aff427ca2c08eb34cca03c","sha256":"f8680ee1190d28226ba412ea7153ffb8c885aca05e2c9869b6b98b4c35f102e4","sha512":"f5302fc01b0b562e4c7a063714992fda9685a704df13dfa57d9587e0d4273d3545dbf0c868005f3fb282d636adc0ecb6a025714bdd59cfaa85f08b556f61c294","ssdeep":"768:lJOp1BfvBTMcB8xhTbaeK56H/h3XJluL5sp4Mr84St:lJ41BtmPaeZHZO6pfrst","tlshash":"96f2d036d2e2a713ec19d1f1d36f5619a64a689c7ad4cbfa23c17f51182e4dd3d80228","first_seen":"2025-12-11T02:11:47.238395Z","last_seen":"2026-09-13T03:05:55.758727Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1059,"timings":{"blocked":1028,"dns":0,"connect":0,"send":0,"wait":27,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqgq713thch2wzykf1i.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.850Z","timestamp":1789268708850,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqgq713thch2wzykf1i.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 6913\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"5f35efb4ecbdd9aa1edaf9f08c85e296\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3249\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6913,"size_decoded":7345,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"5f35efb4ecbdd9aa1edaf9f08c85e296","sha1":"86ff7dc74e061f521b9c6de78bf0f154687eaf1a","sha256":"007cadc781e145821900b4030427b449a2f00fca789184f243e88cfaa377b261","sha512":"d0a16352d33e80288ede2a0668ae4e32c698bd3e95eea9d241d946a058dbebd19a24206dab607d24bd2a93823bfa901226b982359af4909d318c10aa687d5efa","ssdeep":"192:81sihqGJo3iBmv4T+leq5Ad2LW0XODKtUJFEcUuZfry2/licL:zG+3zv46vmYIJ+s22fL","tlshash":"e2e1a0a7236b4c86c3804f774dca8e8b1e6195c6060fe520542bdcdecb277fa86391e5","first_seen":"2026-06-14T14:24:21.50528Z","last_seen":"2026-09-13T03:05:55.759525Z","times_seen":43,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":71,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7hcbxt0vbu1x0waq3ch.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.310Z","timestamp":1789268707310,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7hcbxt0vbu1x0waq3ch.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 47440\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"800b22c1f058aac93adaf03f649481fd\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30819\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":47440,"size_decoded":47873,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"800b22c1f058aac93adaf03f649481fd","sha1":"98582f7219a5724d2d1f8d7e648f872a08aea761","sha256":"cde6e9c24294e39cc4e7827a49732b39be7e221e83b184ddc8d9d21ea7939595","sha512":"b596b0637d602a7cbdeced062497a2ad9fe3b7256ac61aebf1334ccb815c13e46011606731bc08a4843778a6bb2a0d09df374c377845512e4c146578f06e4da6","ssdeep":"768:+uXGTibwbIyAqF7LzUa4kBKN4bXAUml+EFrYmHeU6dk/Sw+F7Nym22xcPD2LJ/WW:xGWbEEhkB6gQVlXq7dkPk7NGgcaZ","tlshash":"7523f1e886b89f53b74ba1355cc7f6608197aa5f850406cfe64d08fd578314bf25807e","first_seen":"2025-12-11T02:11:47.393709Z","last_seen":"2026-09-13T03:05:55.760283Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1196,"timings":{"blocked":1164,"dns":0,"connect":0,"send":0,"wait":29,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/splash_bg.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.323Z","timestamp":1789268704323,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/splash_bg.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:04 GMT\r\nContent-Type: image/png\r\nContent-Length: 505241\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-7b599\"\r\nExpires: Tue, 13 Oct 2026 03:05:04 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_23238-37977\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":505241,"size_decoded":505887,"mime_type":"image/png","magic":"PNG image data, 653 x 539, 8-bit/color RGBA, non-interlaced","md5":"27a95e4efc49b1601cf7e6b98edfffd1","sha1":"860dece14041f191e100c7f936d3ec88cffeef09","sha256":"0bb967d3db89160de06bca8955b41e998315a6cdf4f59cd3bfb2ee9bb231e004","sha512":"8a279a4e2b36258bfff0e301ae5f3967d6393688e951ff5211bacf1d58528157b40c34ba4f901ee73ebcee1d7e9a6de07bfa26b2b6d5c8ffea62027ba203d1ce","ssdeep":"12288:GwC7rJ9S5KGpOA3vbDwmWarx7MRwiP1l11BueO7W:GRPGpOA3vIla9IRwU1lpOy","tlshash":"fbb423a04851d9fab8cd20c39f246b57962a3b524fdcfc1709260f2829bd34f419eaf5","first_seen":"2026-06-11T02:30:28.070577Z","last_seen":"2026-09-13T03:05:55.761058Z","times_seen":83,"resource_available":false,"data":null}},"time_used":508,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":177,"receive":331,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00020.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.375Z","timestamp":1789268704375,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00020.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 26923\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-692b\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23238-37988\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":26923,"size_decoded":27567,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"3189eca07ffcab3d09591bc8a713d4d1","sha1":"d9dbf1e9e9b6c654e77f73fc75029d98b61fa2f8","sha256":"525ab314e04f828d802b14d8e5c418a280f628902f9cfcc8bccddc7342f49f85","sha512":"b887dec82f9f3ebb5362d1727feb0419b9acb60716d6f15724e9f7afafaa7cc4a071b1cf96890936ed7f4b7d2ca5c6fd2aa7ec35b3495637b071dbe8f2014ead","ssdeep":"768:oOPC4x7Iw45uhcrgmnyQ0I+t32FC1+dyOD1ohFk6o:oOPCyID5GcEmVDiz1+dyoQFkh","tlshash":"ccc2f1c30387dd80e0551b7466174fe6e6ded20f7fe69386efa2588d102c7ca29a205d","first_seen":"2025-03-14T20:40:58.547381Z","last_seen":"2026-09-13T03:05:55.762129Z","times_seen":117,"resource_available":false,"data":null}},"time_used":1492,"timings":{"blocked":1314,"dns":0,"connect":0,"send":0,"wait":176,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/channel/index?lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.808Z","timestamp":1789268705808,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/channel/index?lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 84096da368c2d4187ac63c295f077916\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_55446-4892\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":914,"timings":{"blocked":735,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/useMatch-CsbJn8Wy.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.413Z","timestamp":1789268704413,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/useMatch-CsbJn8Wy.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-d5c\"\r\nExpires: Sun, 13 Sep 2026 15:05:05 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_44919-40710\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3420,"size_decoded":1947,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (3419)","md5":"84eae6e9bab35d132e69f5501105c29e","sha1":"4b1273694606cb00e644432998fb879b33428448","sha256":"2ed658bd356979db216ea3e327c2951a5b665a51336e704e6c5dc98fbc0601f0","sha512":"4aa4a8233307fb04db1716caed7c7af98183f314ffe8798865867555a2acd862735e9262dfb9c51370eda4a4987cfc229173727b7abd32e33cb4fbf00cdaa8e7","ssdeep":"","tlshash":"f361148db26628647b774c8a402b0a93b35e6f037df8a5d0445f7e722335d095391a3e","first_seen":"2026-09-11T22:02:29.450382Z","last_seen":"2026-09-13T03:05:55.76304Z","times_seen":4,"resource_available":true,"data":null}},"time_used":912,"timings":{"blocked":729,"dns":0,"connect":0,"send":0,"wait":183,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/favor.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.770Z","timestamp":1789268705770,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/favor.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-50b\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_44919-40719\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1291,"size_decoded":1269,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b834d474b07f0f792966dc913898ec72","sha1":"888740d02360904de0540f710af42ec65c940c45","sha256":"221fb15c1244b73cf9abdb0e87c7ca6db7ebb60260fdab23a1b98d023a89689d","sha512":"6537a7e382e8a1f94e8426e5e0c26c44771492e27700d92fed4672aaeddab606489bdc6a549fbac660999397e5e791e4b4b7234d5755c854b515fe331aa1fadf","ssdeep":"","tlshash":"eb2145b1b2ac060c4118d380efede68c1915e2e397764288f34b21a06e300f7373e58d","first_seen":"2025-08-30T23:50:55.824883Z","last_seen":"2026-09-13T03:05:55.764042Z","times_seen":112,"resource_available":false,"data":null}},"time_used":492,"timings":{"blocked":311,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/mapValue?gameId=1\u0026key=language\u0026value=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.823Z","timestamp":1789268705823,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/mapValue?gameId=1\u0026key=language\u0026value=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: eac4d5a268c2d4186aa7b35c74dc74ef\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_56153-3216\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":899,"timings":{"blocked":719,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd0b72xdj4b7cfrbxirheshcelp4.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.188Z","timestamp":1789268707188,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd0b72xdj4b7cfrbxirheshcelp4.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 55865\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Tue, 09 Jun 2026 06:36:54 GMT\r\nETag: \"fe1d41515ae8dc51288c31e5b50ed4e7\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2127\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":55865,"size_decoded":56298,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"fe1d41515ae8dc51288c31e5b50ed4e7","sha1":"82369e6aac0fdc40e0d8c145a7b3628506b1586e","sha256":"7be632a215bdc12fc39ebad9f2adfa5bffebbcaa7d02861a67b94dee5ed8b92a","sha512":"edf972c1727f2bbbc525241d4f5dc5ea1d9b002f9f63dfa1640b714099138600929a9c12098780db58e5750d583cd42108837df5137c38a4637b42f6a9f8a331","ssdeep":"1536:knWh7MPzmPFuiEUP3Zol3z5Hlk2/EZJd8XNJ4PuG1894I:gWFIKPFJzPJeB/EZJk5G1ul","tlshash":"6e430182c696a997f6f0d83396778eb2f27b204cbbefcc3652c76509152930d4d02781","first_seen":"2026-06-14T20:28:34.270997Z","last_seen":"2026-09-13T03:05:55.76491Z","times_seen":37,"resource_available":false,"data":null}},"time_used":911,"timings":{"blocked":869,"dns":0,"connect":0,"send":0,"wait":34,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/popup/list","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.789Z","timestamp":1789268707789,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"POST /uapi/popup/list HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json;charset=utf-8\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268707\r\nx-cq-sign: d2a0a382a2713d277a5d678432a28e50c2179d6391b3f4f4a4caa3656935524280ffb1e19b5c\r\nContent-Length: 14\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":14,"data":"{\"position\":2}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 8f71e12869c2d41808c73c298dbe9eb5\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04koU196:33 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_50987-6424\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43,"size_decoded":739,"mime_type":"application/json","magic":"JSON text data","md5":"da91329f76a6f74785182f6b12d18241","sha1":"9179a1f2ed6b0762327565e62ce3f6a24353b013","sha256":"80b29d8ecb41ff1101f66bfd49cf97b6063e3ade800881e0a1ff55dc4eb3b944","sha512":"9340dfe9c0bd85b5d30808a89d870c9ceff18b4241d9fefe7f7431bb4748d103adeb0d460fbe2751a45ce42169151e4158e50e4e9e1382ddbc3718cfec79fd30","ssdeep":"","tlshash":"b790040035151c3437035147740d1c0441d43040cd543431ccccddd547d4455175153c","first_seen":"2026-01-28T01:52:24.572352Z","last_seen":"2026-09-13T03:05:55.765634Z","times_seen":45,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":30,"dns":0,"connect":0,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.968Z","timestamp":1789268706968,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_30356-9169\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":441,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":573,"timings":{"blocked":-1,"dns":50,"connect":18,"send":0,"wait":238,"receive":0,"ssl":265},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd029i6die7htl7tc9gwl030by0w.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.214Z","timestamp":1789268707214,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd029i6die7htl7tc9gwl030by0w.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 97634\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Sat, 09 May 2026 14:13:10 GMT\r\nETag: \"c1dab48cac59bbf69d6538d633995ee9\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30807\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97634,"size_decoded":98067,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"c1dab48cac59bbf69d6538d633995ee9","sha1":"0572f9f0c38c16bbb2b79131ed12e63ccd84e460","sha256":"c602dd1b58fa709fdcc6de03ae610c35da4aeec553f96120c707da153310b78a","sha512":"875d03aa03d7977c013293f83e1da9052af9e60b06c7974105049d01ff8818802c6b4e1354432e2503593415c94066afd214562578a28fe24de05f7ca0ceb5e4","ssdeep":"1536:3BVD0NnDs1n4Hp3pR2NdPVvZKfQ7/sI8qC5AmpDsrBZ4bqpSfRoyyPBgldN4:b0NnDs14HpKDVvZb/sIJrhr/tgy","tlshash":"239312a3329270d36b040aede2bab802c76665677f2c03349a46318432df567d4f253e","first_seen":"2026-06-14T20:28:34.142853Z","last_seen":"2026-09-13T03:05:55.766307Z","times_seen":37,"resource_available":false,"data":null}},"time_used":965,"timings":{"blocked":929,"dns":0,"connect":0,"send":0,"wait":27,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-CixQeApu.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.401Z","timestamp":1789268704401,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-CixQeApu.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-15a75\"\r\nExpires: Sun, 13 Sep 2026 15:05:04 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_23850-31919\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":88693,"size_decoded":29914,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (62476)","md5":"918e080b4e39b3829f76bd1f9adce2ab","sha1":"2c02aea3d2d612778ebe2d2c1308bfe11aa02d97","sha256":"1d9697b86040c04bf1927025326d2cea8539381a5810ed0fc794389ccf4bc04c","sha512":"a66fe560b44a604e59126a6cd74bb568645f50dbdedd7c2b7f9a05149752f0383da61e40e495629a4c73b0d80c014cdaedb1b9a18331fa4ff5d0888d49524cdc","ssdeep":"768:Jz0Ze8lIN12totQJemLVYNExYYtS1ClC4F/t+/tdm2Am2AZoZhwjY2JnFA/at+RB:Ca2tot2e9NcwU8hw7csGvQB","tlshash":"5d831749702a5abde2774568b0ed5809720cefc6e141cda6b0fead2237d2c75879c738","first_seen":"2026-09-11T22:02:29.346728Z","last_seen":"2026-09-13T03:05:55.766987Z","times_seen":4,"resource_available":true,"data":null}},"time_used":194,"timings":{"blocked":2,"dns":0,"connect":0,"send":0,"wait":190,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055uny350decgd49facei107j54ea3.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.255Z","timestamp":1789268707255,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055uny350decgd49facei107j54ea3.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 32316\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:59 GMT\r\nETag: \"5f3bbb1605b9a39eaa73b1bdd1a413d2\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30812\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32316,"size_decoded":32750,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"5f3bbb1605b9a39eaa73b1bdd1a413d2","sha1":"2791dbf755e9aecddf4fcc8ca7ad080c86f4de2f","sha256":"82932c15b55da028a47a15d4ff52fdb392037c06f527fbefa99a6dcb4bd9f9fe","sha512":"8013d3007a331aae1744b5ccc3d675bb3501804e47d7a59d00541bfa4ca56fccb3699f274fc9aabd6b3f1b80e2fb19028e7e608c7af2b1fdb0c4bb9f6c9cf54b","ssdeep":"768:b0BGWiU04aiAW3D8TQVvUPX88HRn0nvMvtagG9eTT+eR:b0Bdj1aid4QVvUPsdnmaDwCeR","tlshash":"eae2f1abd136e400cfaac530c552adc936c530b953d1007f5ea530a2b912fbd9aaada5","first_seen":"2026-06-14T20:28:34.177886Z","last_seen":"2026-09-13T03:05:55.767658Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1029,"timings":{"blocked":999,"dns":0,"connect":0,"send":0,"wait":27,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00018.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.373Z","timestamp":1789268704373,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00018.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 25926\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-6546\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_44919-40715\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25926,"size_decoded":26571,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"912b71a18aeecd279d85bacdb700ee31","sha1":"3636c8ded909a6d4079f0df1c26866f5f766dfe3","sha256":"832c4c4cc658d61f365f17f611cc82043b4b674d7411be4f05107813a15469d1","sha512":"bbb641b608deaec9326b22b2d2c0f56e3aa03908df820156f33f2c61198bf2d8aac7401d0127775016de8eba33bc5dfda450a11946b44f99e1578723ae2f8340","ssdeep":"384:4eht36U+OA+CBL7u4SxY1hFtPqbtzb1Ys1C6NXVO7/KDehX5+MinRSekEScl:4A61Pi4hbqbtzb1J1zNXVO74g5RidScl","tlshash":"7bc2e17cde588e90d1a388f40f91680d3c178fa6d049e7b41ade2c5e790f917a7bb161","first_seen":"2025-03-14T20:40:58.476981Z","last_seen":"2026-09-13T03:05:55.768289Z","times_seen":116,"resource_available":false,"data":null}},"time_used":1481,"timings":{"blocked":1297,"dns":0,"connect":0,"send":0,"wait":180,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index.vue_vue_type_script_setup_true_lang-DAkzcQ_D.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.414Z","timestamp":1789268704414,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index.vue_vue_type_script_setup_true_lang-DAkzcQ_D.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-6ca\"\r\nExpires: Sun, 13 Sep 2026 15:05:05 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23850-31924\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1738,"size_decoded":1655,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1737)","md5":"2ff2059283b87d1cc3bd6853d0e48908","sha1":"5470a617013516f663098124f93adb453c6a0d9f","sha256":"92048259f7dcfde65381428c62570bbca34ce13a68e3878baceefea8c472e7c0","sha512":"3a8dd96893302f613a634b12bfc63200085f9792c546a6bad573b7d160b85949560863d544ca62321310c960e68213daff4b647c6e1db47b1d0789778b866424","ssdeep":"","tlshash":"4931668eb812c63ce19710885cb85915a15d7efcf0b59903a7ee84472792872ae8a75c","first_seen":"2026-09-11T22:02:29.465425Z","last_seen":"2026-09-13T03:05:55.768988Z","times_seen":4,"resource_available":true,"data":null}},"time_used":937,"timings":{"blocked":751,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/sys/logo","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.791Z","timestamp":1789268705791,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"GET /uapi/sys/logo HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nlang: zh-CN\r\napp-type: 4\r\napp-theme: 1\r\napp-ver: 1.0.65\r\nx-cq-ts: 1789268705\r\nx-cq-sign: 3b5163c7fc1118b41909084b69befae7c223b53241219f5eeb9f49480188e69180ffb1e19b5c\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: application/json\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 6fe75e8e68c2d41841a7b35c1d5d1c87\r\nX-Backend-Time: -\r\nX-Cache-Status: MISS\r\nx-via: 1.1 PS-CDG-04koU196:33 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50987-6406\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":260,"size_decoded":978,"mime_type":"application/json","magic":"JSON text data","md5":"9ff514c65a24c9e59b7d5fff492fdc1e","sha1":"5624c0fed7ff1289b852d06254094c7343f695a3","sha256":"ca55e030ebdb87dc54e2ec6e826f086d2749b01354461409912c274adb7d329e","sha512":"0fa066d6bfc3cdcdd90f0a506561320807509364ece8cc0b8b7f16c829cf6478c69eb750073aa4279b44383c3d79b39bd904256b962dde64bb25ca9cc9f3c1dc","ssdeep":"","tlshash":"58d05e89628c4978474147e5682b180ea4e93556884cbdd6c8b89fc546943048fc6e20","first_seen":"2026-08-07T21:06:08.200996Z","last_seen":"2026-09-13T03:05:55.769685Z","times_seen":36,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":13,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/document/cooperation?lang=zh-CN\u0026deviceType=2","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.815Z","timestamp":1789268705815,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/document/cooperation?lang=zh-CN\u0026deviceType=2 HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 5d33c39c68c2d41860a7b35c442d7837\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:35 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_2046-65484\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":799,"timings":{"blocked":613,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-jtbDOXiO.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.455Z","timestamp":1789268707455,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-jtbDOXiO.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-22b6\"\r\nExpires: Sun, 13 Sep 2026 15:05:07 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_23238-38001\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8886,"size_decoded":4086,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (8885)","md5":"990074a82e7d091fa39b368efd742c29","sha1":"7624675d03bcebe2ca31a3a40af3285503b25b2b","sha256":"cc46db07cbd76298e53d9bed2d167f0722a5a666d298f975fe3c4cecc834f7f7","sha512":"dd6ee6e1bccb0b2437e832dd3515c7a5565826117dec9a66e219da0125139928f3111b4e36d33a4330a2b95c64af6987f6ac4a279fb774f2bec75188b792c602","ssdeep":"192:bQ3IRB2AswfH4O3pXLB5HU+oH09bQGQbl:b9B2AVv4CpXFFJoH0iGQbl","tlshash":"ef02f88835e37136c67f01b0a06f861563b91ba5e41c85e8e07e77192c5ccb8a3eb64f","first_seen":"2026-09-11T22:02:29.70492Z","last_seen":"2026-09-13T03:05:55.770392Z","times_seen":4,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":16,"dns":0,"connect":0,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/football.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.773Z","timestamp":1789268705773,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/football.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-760\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50640-6029\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1888,"size_decoded":1564,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"611a1a16cd0a281b2ced7c2b0f58ea72","sha1":"d12581b04f6458e5ece0f04fb0769f58d06f3987","sha256":"68513a86d0913dcf8329ba78d339e16ec2d3d39c883f7d406b40adb074c8a2d5","sha512":"e1828ffa3648c44f8eb8058fb5f2887bfb0e3b43baacb3d462194c04c49e38b65d8f8ae36570cd8733caa557f09ac5965b587139ded4fb4f75a5517a960fb8ef","ssdeep":"","tlshash":"c54163f327b987cc9244cb84a2dce8883abaf1c6b2641185f38335989d248f37539c15","first_seen":"2025-08-30T23:50:55.500955Z","last_seen":"2026-09-13T03:05:55.771056Z","times_seen":111,"resource_available":false,"data":null}},"time_used":645,"timings":{"blocked":467,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00024.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.379Z","timestamp":1789268704379,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00024.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 36930\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-9042\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50640-6032\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36930,"size_decoded":37574,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"5c9ef72d876fccdc82cfa10aae18193c","sha1":"be41ce7daa1ad5e418adaf94913a2128726d5f18","sha256":"1a52fa2e4674e371480d974b6322dd48eb8e9212f9b4f4bcff967b5bd25494c2","sha512":"8c775e4efffa72c26d8bd49f89dc4f0c1c7b146c35ccede7228c2b6a5399bde694a4c0dff5a827955987c02318f6be98caeb08d3a38fc34d76af1668ff8c4c20","ssdeep":"768:sRo65B0ch/PKgVg10ZEWbjIWP2kBNbxX1TBQ/QJ+/Nb+VkEdL8YM:sXhh/igVgOZgkBZxPKW+FbChu","tlshash":"fff2f2edf0172d8bff2cb539008fd27185401180ce47afb2b4d995eaa7a5e943e17a12","first_seen":"2025-03-14T20:40:58.569747Z","last_seen":"2026-09-13T03:05:55.771755Z","times_seen":114,"resource_available":false,"data":null}},"time_used":2374,"timings":{"blocked":2189,"dns":0,"connect":0,"send":0,"wait":179,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlpikdazhjbm0lxc0re.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.323Z","timestamp":1789268707323,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlpikdazhjbm0lxc0re.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 78488\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"f5f8ec4f43afe6a0e568d3d0719589b4\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7790\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":78488,"size_decoded":78921,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"f5f8ec4f43afe6a0e568d3d0719589b4","sha1":"474da94937b7490311f3878f64cc99a62b42b20f","sha256":"59486cf7c34d00b84da77fafaf7e0aa3d75506a42c9549309c2551b1de1ef6dd","sha512":"e9eba6f481623c39d23f192f907bdab72f6268cfd0dc5f5e991bba10c42643b8b4a415048f297bf931a26a2481bfe019942a89bf813a757d513341b99d1bd416","ssdeep":"1536:rnO4Hn/L5CEsJ8pbrFcwyjXvNFMxxwUDeuI3IjUSxR85NEb:zhn8Es25FMXtceDIASANE","tlshash":"ac7302ef9666abb498a6745d6d00cdee37b94cf6382b229f45ccd31a01b50b543032e7","first_seen":"2025-12-11T02:11:47.172119Z","last_seen":"2026-09-13T03:05:55.772408Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1252,"timings":{"blocked":1217,"dns":0,"connect":0,"send":0,"wait":28,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00009.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.343Z","timestamp":1789268704343,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00009.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 38511\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-966f\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23238-37983\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38511,"size_decoded":39155,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"6574dcb9a2627f85ee529fb26314a34a","sha1":"d5fbe150eb74c705743582f5322f90107cc454a1","sha256":"2c5b2339b2e6a79852dee97eebf96bfe9541cee9b51c530e732ce636b7c5cc39","sha512":"38947c4eca1301314e7d4d788f5f9ca0a96e32f31ba8b2d2f00067c6c062f875be81eef04de223668da3c88f2311dca6a7a90966978d01f48f4c09c62e7df2c8","ssdeep":"768:41h+HXHePJxWO4sbCG/ztmNJZX/JGVxDAd7kPF88456D+JFYO:41h+3eLCsWG/kN//SxTB4u+Jl","tlshash":"e40302f53d363cbac6369d37b47030a9a04a2ce11161c66d6b537982b6fe4f181e807e","first_seen":"2025-03-14T20:40:58.413467Z","last_seen":"2026-09-13T03:05:55.773054Z","times_seen":120,"resource_available":false,"data":null}},"time_used":1170,"timings":{"blocked":990,"dns":0,"connect":0,"send":0,"wait":177,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00021.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.376Z","timestamp":1789268704376,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00021.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 31351\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-7a77\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_24105-30069\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31351,"size_decoded":31996,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"0edc486c29e804cdd6c413b26c315193","sha1":"ed776a3d84f096c3ff16add3ea78289c7c8d41bc","sha256":"b270b93031a5a1326ce8896aba47ca2e3de8973ecd16897397c9fb39afb9e477","sha512":"858844274d8c5bfb4a7bf0df5883afdcff40dc5ef494904366b424b107bcde28a298565a027e951da4157848846cf4f67eb404c577e3c472ffcc94846b7220ad","ssdeep":"768:1qlq//66c2wBJRqjCHbCXq5UEl/i0/PY1SF7/ZCboYSV:1+q366ABJRq6bCOUEl/isYMFTZCb/SV","tlshash":"21e2f1e76aa38081fd995f3a22cefed2d0a270d122d7cae578f157794a235581f43418","first_seen":"2025-03-14T20:40:58.497318Z","last_seen":"2026-09-13T03:05:55.773677Z","times_seen":116,"resource_available":false,"data":null}},"time_used":2220,"timings":{"blocked":2037,"dns":0,"connect":0,"send":0,"wait":178,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/menu_service.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.778Z","timestamp":1789268705778,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/menu_service.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-4ab\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04koU196:31 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04koU196_50640-6030\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1195,"size_decoded":1236,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9a5b8db1aaf373f9b264ca39f1483033","sha1":"bf349c71b025a499719a77fc7e914b80de92f625","sha256":"fc56d75008d858af15040313b8306a4e2f1208d7dc841f4d1f0183b9ed69c081","sha512":"8f2b4bfe274a4849269b97eb1756ca9c740c9de2a52f44d11e8efe843ddc21239de110a9cd467c81b2354e03816f5340cb4dcff9852dfb9bb45089f9e2a4e5d8","ssdeep":"","tlshash":"7a21f1f1a1ed410c8055c340d2fcba49162ef383a3556298f3452126ae284bf3d6e55d","first_seen":"2025-08-30T23:50:55.212919Z","last_seen":"2026-09-13T03:05:55.774446Z","times_seen":111,"resource_available":false,"data":null}},"time_used":823,"timings":{"blocked":645,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/hot.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.775Z","timestamp":1789268705775,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/hot.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-41d\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_44919-40720\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1053,"size_decoded":1226,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"556d1f2ef7e8adfd45c7f31be19e0694","sha1":"0554d80f6186c8cbfd6d101f2625603908c437af","sha256":"f722c4e97bb08bdae4eacf093272f589945cd53f7d6bb4d18cf7776983a32ae8","sha512":"f98bd6ea07f255298b3cabe41a36c6c4063bac0876645e9c06b6f02c8265f5fa76c62c06b7b70770359ca808039a8e79b2d2c7aac1645823e69086b66e62099a","ssdeep":"","tlshash":"e0111fbaa6e8854c87044344e6f8f549103ef1d7e7182048b78e35a99d241b3be3f14d","first_seen":"2025-08-30T23:50:56.013554Z","last_seen":"2026-09-13T03:05:55.775265Z","times_seen":111,"resource_available":false,"data":null}},"time_used":670,"timings":{"blocked":490,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqf3q0p2scbvlazccaf.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.839Z","timestamp":1789268708839,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqf3q0p2scbvlazccaf.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 3295\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"a1fc4a34f1562b2331f4aaf83ba98674\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7796\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3295,"size_decoded":3727,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"a1fc4a34f1562b2331f4aaf83ba98674","sha1":"ced0248a37a33bbc457188d107ce573d403672d2","sha256":"169bf0908128eeb84cac3517d17a047e01459a71cb2c999b10962caffcd56c69","sha512":"90b0b01510a4511d89fc88e8d671cd766292fc4ffa76fd93dcb658306700be5e73b9c4a8ae006b84734eda35ba92b3c0ca45b1c71a9dac87742aaf4bf09294b9","ssdeep":"","tlshash":"cb617d0ed2f6b20ae9f808306e04b28d43d972571573075fac3bb03508e698a90b7257","first_seen":"2026-06-14T14:24:21.406621Z","last_seen":"2026-09-13T03:05:55.776039Z","times_seen":43,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/msg/indexNotice","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:27.012Z","timestamp":1789268727012,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/msg/indexNotice HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:27 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 479fc8666dc2d4187bcb3c298f20ff3b\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612f7_PS-CDG-04VRO197_29158-32135\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":180,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/right_activity.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.785Z","timestamp":1789268705785,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/right_activity.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 21624\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-5478\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_24105-30073\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21624,"size_decoded":22269,"mime_type":"image/png","magic":"PNG image data, 120 x 179, 8-bit/color RGBA, non-interlaced","md5":"a334770b75f7bb0195f35ea5e112efd2","sha1":"040b02717122fb056041c52c5bb6bfbeb3331cca","sha256":"2cd7abc4f54d415082e6ad1ca98b5380f82e459607a62dc0e111a51201b8f290","sha512":"a9b0c477d4bf109a7bbac09e72edc565dc67d20778aeda68dabe69bea7fe663138a8d68fb5a61c46a20d9b201b5059546fb934a8186b1601422615497712f612","ssdeep":"384:8SmCjl8FEY8YxAao3QN4FvGnbZS1YZZezSw7R+E9EUC0zwDVkZWceEanhE4O6wm:8Sm22XTC24Fob7ZS57R1SUHzwhc3anWI","tlshash":"05a2d08aa115e344e24c4b1b6f4ad679c7f22b24e54e124a2c7498f9747a81d60fdf0c","first_seen":"2026-06-11T02:30:28.042227Z","last_seen":"2026-09-13T03:05:55.776828Z","times_seen":70,"resource_available":false,"data":null}},"time_used":1391,"timings":{"blocked":1209,"dns":0,"connect":0,"send":0,"wait":179,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/popup/list","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.791Z","timestamp":1789268707791,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/popup/list HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: f13a2d1c69c2d418e5a7b35c95bafb23\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_29158-31981\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":719,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":969,"timings":{"blocked":790,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd026cfdibgseqyo33blqh9gqc2b.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.830Z","timestamp":1789268708830,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd026cfdibgseqyo33blqh9gqc2b.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 18591\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Wed, 06 May 2026 08:52:10 GMT\r\nETag: \"05ed1dc30e47d6236a315fb013691ed3\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7795\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18591,"size_decoded":19024,"mime_type":"image/png","magic":"PNG image data, 284 x 284, 8-bit/color RGBA, non-interlaced","md5":"05ed1dc30e47d6236a315fb013691ed3","sha1":"efe61fe8adee614b6f49a11148581b39f9e49133","sha256":"edddd9684e4a7128a01d8ee0c8c8f76a1f6edc39c9472c829078459467aa0956","sha512":"d42bad2162ee674eceee91e67cf918b32aa445d0393320ccaae8d3982cd31f3397d7b5096a060a56273119bc4a99febc62afb9594b0e400c4cebb782b5efff72","ssdeep":"384:eFMh8NUHUML2Yc5N4M5GCU9Ta6IIR704yrm+KrScPceNz4PvNBb3Z:DhdbL2XMMACUs6IQ7urj2P6PvNBd","tlshash":"9c82d144e7bcca1e6547c0bf034988d4c33a1857f28e204ef5c5b8a6d866eb97726c5b","first_seen":"2026-06-14T20:28:34.135935Z","last_seen":"2026-09-13T03:05:55.777638Z","times_seen":37,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-BjHNmcI8.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.402Z","timestamp":1789268704402,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-BjHNmcI8.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:04 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 874\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: \"6a9e5e6a-36a\"\r\nExpires: Sun, 13 Sep 2026 15:05:04 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_23850-31920\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":874,"size_decoded":1527,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (873)","md5":"966626f1d60f43ee66e6a26e9f431f8a","sha1":"47c144de4cf32aa987cbdffab9a9b03540c4d8f8","sha256":"388669616654fce39665730923a61ebab9e946257799d4f5fda1cda757055d14","sha512":"73d17fc246ee6b966cccf48176e7794cc96ebd4ea0ff608cd939c155a12967ea450548a4d2dbb2c46826e3992ea2f7d221750393ed6ada21ab745bb5dbc6ffab","ssdeep":"","tlshash":"341112c9ba111b39b4fb042da9583d15350e25eaa33c9c80b3aa1cac80e5b77434d611","first_seen":"2026-09-11T22:02:29.318697Z","last_seen":"2026-09-13T03:05:55.778625Z","times_seen":4,"resource_available":true,"data":null}},"time_used":381,"timings":{"blocked":194,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.962Z","timestamp":1789268706962,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_28847-10781\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":442,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":369,"timings":{"blocked":-1,"dns":56,"connect":23,"send":0,"wait":240,"receive":0,"ssl":49},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2dea6edezpplh1jy9rso4k.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.235Z","timestamp":1789268707235,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2dea6edezpplh1jy9rso4k.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 28447\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:47 GMT\r\nETag: \"58deac0de5d4b462d23ec693f301cf46\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6961\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28447,"size_decoded":28880,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"58deac0de5d4b462d23ec693f301cf46","sha1":"ef654bdab572d4b20ff63dd0aa357d4f7ad222c8","sha256":"71d4c8bfafbb54b951e307eb52804258e7bf7b3da859c94cf46ddfaad46a321f","sha512":"a8a680775621c260f69cfc5fff455c9d129ad3d5dbeffe58dbff37f132ae16eccb04a9d6adec2ffc8ae3c9b89b5dd87a6f1ea20643c65e1e7a3e133e37191d01","ssdeep":"768:6Q6IbM7qsreElnDbZEIvN6omIL9+Qmoqcw7u:6Q6yeekDbZEIQa2cwa","tlshash":"8ed2e01e8fcb37dbebb4087da3be7a2424204213d79c50191ccb255857eb2b78d469da","first_seen":"2026-06-14T20:28:34.057949Z","last_seen":"2026-09-13T03:05:55.779581Z","times_seen":37,"resource_available":false,"data":null}},"time_used":972,"timings":{"blocked":941,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd016axdhsige5gkrec8iaiqp2hh.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:09.841Z","timestamp":1789268709841,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd016axdhsige5gkrec8iaiqp2hh.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 560\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Tue, 14 Apr 2026 02:10:04 GMT\r\nETag: \"b638b6d8962f0b485c402bba04713459\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04uki195_56153-3256\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":560,"size_decoded":991,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit colormap, non-interlaced","md5":"b638b6d8962f0b485c402bba04713459","sha1":"0b236c721a7ea410fa32d254267d01dfe6a812e8","sha256":"2697bb07e96adbc924076ab2e95cdd84ec083c61f63e60fb9aabb22c05b6366f","sha512":"4a451b5a9c63a04ab4a2049ac4cb0795a93ecb460907ee4dbe503f72ee14dec99ba0bc8397dca450b6d110edecbe4f4411b3d5cc03062e1f2a4c03a2d2dacf1c","ssdeep":"","tlshash":"9cf096d50a954f2372e2b90832b20005f299031f15a63694ce1c537c244fd49c8cbe02","first_seen":"2026-08-11T06:14:41.202457Z","last_seen":"2026-09-13T03:05:55.780457Z","times_seen":6,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/statistical","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:25.706Z","timestamp":1789268725706,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/statistical HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:25 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612f5_PS-AMS-04DYH56_28018-10085\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":442,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":238,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/swiper-vue-wuF8Lk5Z.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.405Z","timestamp":1789268704405,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/swiper-vue-wuF8Lk5Z.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:04 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-15be7\"\r\nExpires: Sun, 13 Sep 2026 15:05:04 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_23238-37978\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":89063,"size_decoded":27029,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"2d460e9501dfb31b559fc38da47abca7","sha1":"b2a1efab528de8f7aff7706da8a19489d0dd74e7","sha256":"d6731cf296d85f85ce31db143d716a7cc491e02a6c78b9c6a678423af5c9ce8a","sha512":"3c1eccc2bfcc09770876f833310da9a0b776f9799a3bc1cd751770c42c8f11815690b15cececbb8c9b6ca72164359953ebbde7a44372d0b7f18ce8260f8a8780","ssdeep":"1536:tEo9IEmlUJD28Qv7BH0/PMLfF5pkDsSbC9mLKBlxvH5u98zkYXiA6wZ9//PSL/kJ:ao9rmU/PMLfGDjsHa2","tlshash":"9f931989b224b17742f759da9375c20172a14d44b849d8e4b0ee8c7b496ed5c03aeffc","first_seen":"2026-09-11T22:02:29.639585Z","last_seen":"2026-09-13T03:05:55.781559Z","times_seen":4,"resource_available":true,"data":null}},"time_used":590,"timings":{"blocked":410,"dns":0,"connect":0,"send":0,"wait":179,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/notification.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.763Z","timestamp":1789268705763,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/notification.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-467\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23850-31929\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1127,"size_decoded":1242,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ac31edb06ed58d95f2b646f4241b6e2a","sha1":"6ac60af5bc49ee32495e475ef8d47f384290a3e0","sha256":"91e5d71f74a86f194d60193c6265be5ff042d938215caa685ce52f3c5ccd2380","sha512":"8db619f62f5fa3f07abf4ea33b6827c754603d93ef025fa7f81de0f1088488a21ae352be31cd648de385f9735f442624026c12803aa9ea71f516bb7146effb1e","ssdeep":"","tlshash":"cc21bbb903fd471cc5684768d3e4b79c277ee082b254a084bb9612564d418bfb77a928","first_seen":"2025-08-30T23:50:55.793471Z","last_seen":"2026-09-13T03:05:55.782399Z","times_seen":114,"resource_available":false,"data":null}},"time_used":341,"timings":{"blocked":156,"dns":0,"connect":0,"send":0,"wait":185,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01kmad66yxe3d8gh4p4r8k3cs9.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:09.008Z","timestamp":1789268709008,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01kmad66yxe3d8gh4p4r8k3cs9.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 1703\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:07 GMT\r\nETag: \"8b17d869660d015ee310bba0bc51bb48\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04VRO197_22295-30829\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1703,"size_decoded":2135,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"8b17d869660d015ee310bba0bc51bb48","sha1":"56a578e69e871afd342aa6ea892f418669ade280","sha256":"901531a007bcc237cc752e4f9fdb0d61a049a644ce262f84256200f0be65364f","sha512":"bdb9fb6a3a8c6700a69d8a804f57e5595ab5591b4bc98a5e6c0288574ea6509bd46642007b24cc34be13f42f9a32bf52783e49d2a5b99a2f2babd29092743156","ssdeep":"","tlshash":"a931fae7b2eb437de3a12c6658b61afd993c1b493e87133c9255554a421b1d230cc545","first_seen":"2026-06-02T06:09:34.382418Z","last_seen":"2026-09-13T03:05:55.783212Z","times_seen":45,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":41,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/mapValue?gameId=1\u0026key=language\u0026value=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.825Z","timestamp":1789268705825,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/mapValue?gameId=1\u0026key=language\u0026value=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 2d91cba468c2d4187dc63c297a920d2d\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_29158-31960\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":932,"timings":{"blocked":753,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un52qtdeekmq9qrnct3u0p6245a.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.179Z","timestamp":1789268707179,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un52qtdeekmq9qrnct3u0p6245a.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 325667\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:56 GMT\r\nETag: \"97fd832278dd9856cb94575ef06bfff0\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30805\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":325667,"size_decoded":326101,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit/color RGBA, non-interlaced","md5":"97fd832278dd9856cb94575ef06bfff0","sha1":"7bcbcd830545dd1a85a2c143158f0232148e7d61","sha256":"c3a6df1224e44f241d0158dd641d9d562e0e345022cd4f4f893558ececf98aa0","sha512":"4a5b69e515ee5c9858fe2122218764c334112f55093eca9918784ae2454e72eb015c17fad7a59036ef16b80e9d8c5946f21a68da5f05f6cb87fa1f93d0dbbbc1","ssdeep":"6144:nIAcQ+04eyagITAvMqzaRZgmNYWvQNT+6DBynNjA4hh1mdpkAcSzyWj1roW:IVHuTkMqOROUzvirsnNc4hfmrrcSu0dT","tlshash":"9d642363adb26c277c1683428763ccd11fa442d1f9de22f6017789921dabe8790cdc97","first_seen":"2025-12-11T02:11:47.176503Z","last_seen":"2026-09-13T03:05:55.785031Z","times_seen":42,"resource_available":false,"data":null}},"time_used":954,"timings":{"blocked":847,"dns":0,"connect":0,"send":0,"wait":33,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlkedgzhhg8p05khj25.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.336Z","timestamp":1789268707336,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlkedgzhhg8p05khj25.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 48952\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"26f4cc61ab3581b2899a4b65ef7f35c9\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33034\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":48952,"size_decoded":49385,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"26f4cc61ab3581b2899a4b65ef7f35c9","sha1":"055859a7943b9c174c591c4844901134ca9e2705","sha256":"a017a9516819efc90a6c72986ec0cbc6c3c4476d9d6a008aea2873839108b152","sha512":"50b72acbb33165c41dd4d5e6ba85b3340f8538740f535c1c596de5469fda1dea24deb348db0c76d5a828b2d133e854df6aff8f3155bdd2a55cdb6b45d7c39a24","ssdeep":"768:NBcLeKDHpHohw+IvxEkcMc/mseR/0JVkWsqyyumy111/8L6N5FDfbLwuqX6kUJyR:4eKDJeGvvc/ms40L81me6YvQxzTQI2fa","tlshash":"ae2302c4a5facc14adb4e0086a597feb78f1309331ce9f8d66cc567e51f04466bb6209","first_seen":"2026-09-06T17:58:09.561448Z","last_seen":"2026-09-13T03:05:55.786329Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1258,"timings":{"blocked":1227,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.428Z","timestamp":1789268707428,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_28018-9786\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":441,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":635,"timings":{"blocked":395,"dns":0,"connect":0,"send":0,"wait":240,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-BgXo_eUf.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.448Z","timestamp":1789268707448,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-BgXo_eUf.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-9507\"\r\nExpires: Sun, 13 Sep 2026 15:05:07 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_24105-30077\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38151,"size_decoded":15490,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (37660)","md5":"cce1f32181a75926a281e067006b748c","sha1":"e2d6242c367d1f7ce63d959373db58698659d2eb","sha256":"214d16c145578c59161c64995026f3ae23162c5ba0765c2f6b176804d13fd04d","sha512":"74f2eed1ef0244a7955034642e54d63433853aeb2108c9f276129e2f8622510cc4005d62e224235e264922d72a49a1f0709b67a76a57bd7a5c792483a60eb04a","ssdeep":"768:dZRBdHnvomPNehOTDLOY72qB2USjTPqB0S6BptkVJR:dZDhvRkaLD7TB2vuREp4","tlshash":"3203e7e432b1f186a7eb28f151efa046f2356d88980c15b5f10d9af93cb5581b72af34","first_seen":"2026-09-11T22:02:29.443808Z","last_seen":"2026-09-13T03:05:55.787287Z","times_seen":4,"resource_available":true,"data":null}},"time_used":182,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":180,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/msg/indexNotice","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:16.594Z","timestamp":1789268716594,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/msg/indexNotice HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:16 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 6917edf96ac2d4181aaab35c9a53c67c\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612ec_PS-CDG-04VRO197_29158-32027\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":181,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9t9xfs06b3i70ks3qgz.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.240Z","timestamp":1789268707240,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9t9xfs06b3i70ks3qgz.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 67535\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:44 GMT\r\nETag: \"99566fc74a4b509fc269844ec95b1e70\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6962\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":67535,"size_decoded":67967,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"99566fc74a4b509fc269844ec95b1e70","sha1":"68717ad776cbad41d0b177bb7c9616552c2e8968","sha256":"f03f9cc4b821f46dadbf184130942446ae4f8b10ea12157b765d944b61436833","sha512":"d38a1dbe5bfd4315f4431c20d716e5e70ed0d99bd8ef0042521da53fdf162da1556f260ed719e87f540b07e5aa66f5e7184f30d7d1d4224f2d2d4e9dc92df1e2","ssdeep":"1536:Rsx3buluMqNsf3xifaAHGHb0IJD1Pin5RZwHhH9AA4:RC3ql5PwbHGHbV5u5RZIhdc","tlshash":"d563024c3dc3a9d14691b5b0e8f1c4b2781e8cda084d7faf9e9e60c9749b3eac864117","first_seen":"2026-06-14T20:28:34.086785Z","last_seen":"2026-09-13T03:05:55.78819Z","times_seen":37,"resource_available":false,"data":null}},"time_used":998,"timings":{"blocked":962,"dns":0,"connect":0,"send":0,"wait":31,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuql99vod0mwi9gwf05a.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.858Z","timestamp":1789268708858,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuql99vod0mwi9gwf05a.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 7095\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"db5fa94046963005591b5f028ed0550f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04VRO197_22838-33041\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7095,"size_decoded":7527,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"db5fa94046963005591b5f028ed0550f","sha1":"ac3389c5b07e2c46a0e5d3d447445c26a1f76f95","sha256":"9628fdc7a71505355cfe00b66350110b244b5aea31ac684c999aea3c9d82298e","sha512":"a60e2f146a5895f34739c2476d4b471cc74d83701b859f7559c5d0a32e8c2efdfcc9cb1fe5c2f164147af37260e19436108569fe62a8c38e65bf92cce245f487","ssdeep":"192:5s2sf1C1ITgBdmS1N4pDauUuP4U2V3FZXHxt:57s9UiSOJLPCZXHxt","tlshash":"9be19eb50fea7c25db16eb10015a1609fa66e8d811d90f8d2c38f85ca9884a877535f7","first_seen":"2026-06-14T14:24:21.310044Z","last_seen":"2026-09-13T03:05:55.788977Z","times_seen":43,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":170,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/g9kdwd0b72xdj4b6vzkkzbiger6ugnra.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.208Z","timestamp":1789268707208,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/g9kdwd0b72xdj4b6vzkkzbiger6ugnra.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 31393\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Tue, 09 Jun 2026 06:36:18 GMT\r\nETag: \"270643a3608de3cd5ef253847eb05d6c\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30806\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31393,"size_decoded":31827,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"270643a3608de3cd5ef253847eb05d6c","sha1":"11d721db6adf586dea1a52558e476d22302c9ee3","sha256":"d08c44a1a9a6abb9abcb43aa25f8179ceef8c7c90915107d2bb3e533a5e54128","sha512":"dc28b8a7121a6d4cb069fdbd0c3725ba0992fbad1c0ab05b4208657ea4e387877abc7d3aa18996482a8d0ea7c49dc6b07f550da100eab1b14816deb5ac2e2299","ssdeep":"768:ctZX/Uil+WF5nj0kStxY/r8XuJ+yzr6ZeSMzGnnBK:c7mWF5j0Fk/r8Xfor6H1BK","tlshash":"aae2e1ad0ba68741f32aa539883a7fdf78c6094538671ade5bce321d037dd70982905a","first_seen":"2026-06-14T20:28:34.300676Z","last_seen":"2026-09-13T03:05:55.789695Z","times_seen":37,"resource_available":false,"data":null}},"time_used":931,"timings":{"blocked":901,"dns":0,"connect":0,"send":0,"wait":27,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9tdi20jvpvj20uj9eix.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.245Z","timestamp":1789268707245,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9tdi20jvpvj20uj9eix.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 97684\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:45 GMT\r\nETag: \"d2522a8a1844857c542440af3f8d4ae1\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30811\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":97684,"size_decoded":98117,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"d2522a8a1844857c542440af3f8d4ae1","sha1":"d409e3d5b29a91d7c6a10803d9a48790d947c1f3","sha256":"434a6a22d3bb653fa19467c701c912db59f064e811d4baaccc32ec22e35e15c0","sha512":"69e3f7c5bd09c40da958954f762c11296494e6226219b9213b8023ca72f746cab73e9509cb8e4cd0cff6f146da1296814007cd97f87766fe0b60cbf30453b235","ssdeep":"1536:wz3cZBhzE8JuiLkD9vQIugtJgBQsFwnRJJ3OzZ7Jux6qqJ9j7aqyS44lCiGsviZA:y3cdxno59ukJgBQsFwRrg8mf9yJSZW2X","tlshash":"f8a3122a33fe53e4612bb63a110e8cd95b63d74d47a21f29e5c4f140e6b842630b5a8a","first_seen":"2026-06-14T20:28:34.299777Z","last_seen":"2026-09-13T03:05:55.790476Z","times_seen":37,"resource_available":false,"data":null}},"time_used":1001,"timings":{"blocked":965,"dns":0,"connect":0,"send":0,"wait":27,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00007.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.340Z","timestamp":1789268704340,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00007.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: image/png\r\nContent-Length: 37486\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-926e\"\r\nExpires: Tue, 13 Oct 2026 03:05:05 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:20 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04h2Q194_44919-40712\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37486,"size_decoded":38131,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"ff3a4eddb0be6522b63d1515192c06b6","sha1":"35429c6061d7c2b9c9d8aacc78640e72e6194321","sha256":"54b27ee9bd579925e32a73a4dd18bc4d6be77278d27141fe73f5099298c2e793","sha512":"be0d4e9f59f844cec0bb9d30384fb84e7fefd15a0c89088d830332cffe5f163d67c9f97e9213ab752fc1b6d2e190fe96aeb28387f9f3a82a5cf008cdd2016aab","ssdeep":"384:7XYJTT5pWwA5SYNZOppiKy4GipKuPo5OfIR0Ndu9GJXmm4kO2JTPePM3xV347FD8:7wTWKehgxg9GqkhJTPeU3xV347HtWT","tlshash":"1ff2f1853d4188a8d496c470362daeeeae45d1c4ff26dcb5cb73d2a8314a4a737acc20","first_seen":"2025-03-14T20:40:58.428363Z","last_seen":"2026-09-13T03:05:55.791141Z","times_seen":124,"resource_available":false,"data":null}},"time_used":1146,"timings":{"blocked":959,"dns":0,"connect":0,"send":0,"wait":180,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/DIN2014-Demi-DS8C_To_.ttf","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.757Z","timestamp":1789268705757,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/DIN2014-Demi-DS8C_To_.ttf HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/assets/style-BAEGjb_c.css\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: font/ttf\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-26914\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_24105-30062\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":157972,"size_decoded":72289,"mime_type":"font/ttf","magic":"TrueType Font data, 18 tables, 1st \"FFTM\", 24 names, Macintosh","md5":"04a4dbf6f7759b4a206a58c61926f02a","sha1":"a938e661c286e46f949d288717827bc0c96127f0","sha256":"5580f1f504dc6cdd866f2cbe4abef859a91e6c640a98f207a36fbc6a27e7811d","sha512":"07afce5e4b4ba18e56c954b968a8b849c7c6e7c9be691ab6896d1bf61f3b55845db3bacc376b80513cbdf52bb5d89e148a8cd9417b5c0d791e2168574c1abf61","ssdeep":"3072:6rTGvBulqb2zn6DkYLT0TmjeglD0MUqhLwHIZCY/Tj8c0p9MlztsRHVeK0H9:OTQBNS+XTM+zUqpwHIoY/X8cSOZtsRHY","tlshash":"e0f32aa1f285776edf531d3a447142accee1ca3fade80bb6ad762c9749110b88c51d8c","first_seen":"2025-08-30T23:50:55.900453Z","last_seen":"2026-09-13T03:05:55.79174Z","times_seen":113,"resource_available":false,"data":null}},"time_used":335,"timings":{"blocked":141,"dns":0,"connect":0,"send":0,"wait":182,"receive":12,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedln4tcu6rla70c6r367.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.329Z","timestamp":1789268707329,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedln4tcu6rla70c6r367.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 85694\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"e0a5cf1caa4abe3d775f21a12d448ddf\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33033\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85694,"size_decoded":86127,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"e0a5cf1caa4abe3d775f21a12d448ddf","sha1":"7bf66f280326a20f10f00d19c2ad6e1fddfb23a9","sha256":"f5d629f15931c89597cc758277f8ee67f776b29b3fe642df30d75b6a495d3ce6","sha512":"2c3a8803522fb933a1d4545c71234abbd2589c91ddb3c5bbb4df09811b292d573b8925d8ce10937b5a5cb04b88c83afc67e475691ecfd92be48aa179f264e135","ssdeep":"1536:nuomu35INFuvtP/D+67HZggfpEExlonrArC5kHptA2e5GV+g2DniLkp:n5mWqUVP/q67REExrTQ29iegp","tlshash":"9f831150a15d027fbc622eb695f629eb1e2bd47907c84a4d7a84343c2662cb7c347b2d","first_seen":"2025-12-11T02:11:47.366272Z","last_seen":"2026-09-13T03:05:55.792397Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1272,"timings":{"blocked":1239,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqgv18qtdrhi4ku3lt0.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.837Z","timestamp":1789268708837,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqgv18qtdrhi4ku3lt0.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 7173\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"a4289b35a9118039f737017d84b6c784\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2149\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7173,"size_decoded":7604,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"a4289b35a9118039f737017d84b6c784","sha1":"c2294c8dc432e8b7dbf64d6e7f2f5bdd2730c78b","sha256":"c9aee875683d23224546bc0d99331e794f336cb96b656dc87ef660c19cb11aa6","sha512":"7d34d65a25309ccef3f031d036a4862ec98222383bcee95f90e6b32d6d0423f48ec3d17e8c5afb147c1c80f0961cf189fbd8b835ace44549747b4ec981ffcf28","ssdeep":"192:G3647BBNd/vLrUsy7WzDzrl4v+Gl/n+2KzJMb:86uzyazrl4Wev+2G8","tlshash":"5de19d8ab349cf69c5eb1cb1522934564e04d9c07be3a2c41c66a13ec492f80df6676f","first_seen":"2026-06-14T14:24:21.540939Z","last_seen":"2026-09-13T03:05:55.792994Z","times_seen":43,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkx2gv1v4h5l07pl20c.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.280Z","timestamp":1789268707280,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkx2gv1v4h5l07pl20c.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 42310\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:26 GMT\r\nETag: \"c9ced24017ec8203d6959cbfa5dc62cd\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7783\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42310,"size_decoded":42744,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"c9ced24017ec8203d6959cbfa5dc62cd","sha1":"fdc0a59e615819c83078fdc672cb12c7144addff","sha256":"b006a0ebd64c6791360c64f2c79a034f743fd931c576f9db695ba0c9bc612623","sha512":"c80bbfc007a1ceea6f77cbe91196191d910c2c20491bc09c7aa723ab0d8bedc77b91c0ca5fdc546c55e617ce83f5dacc8944375f497a6dd289a52c9ecb6e4edf","ssdeep":"768:w3v7ZnV4ZebaIFJjA83Z92IWVrWDpunfrpRvXnd5fI4d2:wlniZebZJ883PiVi2vXX5I","tlshash":"bb13e026b3b3a693d337fb7aca8e58c7fe421a7c6380188cd7c5211e717548050a6a6d","first_seen":"2025-12-11T02:11:47.308973Z","last_seen":"2026-09-13T03:05:55.793683Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1098,"timings":{"blocked":1068,"dns":0,"connect":0,"send":0,"wait":27,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7hat7dc4qs1204c1d1m.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.316Z","timestamp":1789268707316,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7hat7dc4qs1204c1d1m.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 53552\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"22879f84beda494d2d03214b1ca1897b\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_48246-7789\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53552,"size_decoded":53985,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"22879f84beda494d2d03214b1ca1897b","sha1":"a2912ca201a4cd31000e9fbd6d7d807a5e384607","sha256":"c4ea9ff9817685807e160e998255a9e735e4490a9b19dca75cd7d85e1e438bef","sha512":"8aa7bdffe350b56d954eddae155fed50d29f34d8c8799fb9160c17844a1c017fa11d4b875d054a3d87f801d85cb6b5c51380c1e8254bfc0b0d0ed4efd4f88201","ssdeep":"1536:teusPT1g0v2itYjnh+vnqUuUYpw0I5IISQelp:teFRg0v2Y+QPPuJpfAIrQop","tlshash":"a733f1a6dc6e0c8c863d10648dab3d5844f4914409e19bc25ee6bf03f72b54b9c6ae9e","first_seen":"2025-12-11T02:11:47.410551Z","last_seen":"2026-09-13T03:05:55.794339Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1217,"timings":{"blocked":1186,"dns":0,"connect":0,"send":0,"wait":27,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/index-CCXActYZ.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.447Z","timestamp":1789268707447,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/index-CCXActYZ.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-1c62e\"\r\nExpires: Sun, 13 Sep 2026 15:05:07 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04VRO197_23850-31942\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":116270,"size_decoded":36244,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"c9ec82473b150dd8c13917df92b349fe","sha1":"387d0b2621b45f19d2937538f1e4cf850b5f0152","sha256":"168a1cacda321395570886cddfcdfd5203b76c8a709ec745387fad7b2e6cb0d1","sha512":"b7e375a578ef5218fc4175fe268ea1a5e8a6fee40ab44fb0ed981bb1ac112e0320596b9f30c2b9ab99094cff587a31d1e9fa1bbc0c063dfbb3753aa06d5896d9","ssdeep":"3072:orml5OVXlH/fi1xRQpfmiFm8hqpRi5sfBP/ml:gmjeXly1xRQpfjFm8hqpRcsfBP/ml","tlshash":"c0b32b48785579378a7b04d5809f0c05b3780b8dd42499d5e1bf9a9c3bcac247bafb2e","first_seen":"2026-09-11T22:02:29.667745Z","last_seen":"2026-09-13T03:05:55.795012Z","times_seen":4,"resource_available":true,"data":null}},"time_used":191,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":190,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.970Z","timestamp":1789268706970,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_28184-11996\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":442,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":571,"timings":{"blocked":-1,"dns":47,"connect":20,"send":0,"wait":239,"receive":0,"ssl":264},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1bwndeck69uh9087a00q2gl3j.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.291Z","timestamp":1789268707291,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1bwndeck69uh9087a00q2gl3j.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 41560\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:15 GMT\r\nETag: \"b8820cadede4b1bfc31197a2269524ed\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3235\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41560,"size_decoded":41994,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"b8820cadede4b1bfc31197a2269524ed","sha1":"d4f51bdd0cfac4a81fcd0e91d0270b31f1489f51","sha256":"62d082ab86afcdd1839d2486bb66c3b0156051d49c25815859e701757b278a5a","sha512":"2090a3d3adf1592cbc370badc44146a31725919bd060a1651a5254e7480c7e0068e6a0f9c9f7c24100e6efb93cf45104eb78d3f7c8ae924c15fc600bfd9d602a","ssdeep":"768:A3jyfuYwXxDN7C8vtfy5lROKA2swx100ACSK0sqsSEum89OfURYIGV:ejyWYUb7CWy1OS10LCSZsqsgm8AKYIg","tlshash":"eb13f281cffcb778daf8b57a2bbffd16c5e49056d8604b6715f8a8009a4b0841e87960","first_seen":"2025-12-11T02:11:47.195203Z","last_seen":"2026-09-13T03:05:55.795681Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1126,"timings":{"blocked":1095,"dns":0,"connect":0,"send":0,"wait":28,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un29d1de7hbrkzozci1k00en7i0.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.293Z","timestamp":1789268707293,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un29d1de7hbrkzozci1k00en7i0.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 54752\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:42 GMT\r\nETag: \"236207f4df4605f027585ca0fc415e96\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2141\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54752,"size_decoded":55184,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"236207f4df4605f027585ca0fc415e96","sha1":"aa73d06e4c27bf97c88c5c79877ced0811d3a427","sha256":"3af3ae8265231229d82f942fc53f83b7704faee38e68eef94362d9243fb07988","sha512":"28846c7dbf2389e073ba43ce68610da6a3e16042f39eb93f09f7bbe012ea351fb8be58642f9c6dcf72847c98fb5485f4af8b6bc21a8f9ba69be4160dcf06e5bb","ssdeep":"768:VNUFAEJwZI9mzDLr2V4SUCk369Vez4HPhvhaQ36/ZccvQsxNE/DewZfIl3ZDJV4r:VhJwo2V/UL36naGUQeZDQ8WKW0uQAN","tlshash":"a5330291b1f80707724c22242fd8b6ccc909dacaf1ef645c7755246a6b968d4bc9dfc1","first_seen":"2025-12-11T02:11:47.273094Z","last_seen":"2026-09-13T03:05:55.796402Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1138,"timings":{"blocked":1108,"dns":0,"connect":0,"send":0,"wait":27,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/agent/supportActivity/entry","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.807Z","timestamp":1789268705807,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/agent/supportActivity/entry HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 901d728568c2d41833a7b35c4aec2c3a\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:21 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_25562-30845\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":411,"timings":{"blocked":224,"dns":0,"connect":0,"send":0,"wait":187,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/common/ip","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.415Z","timestamp":1789268704415,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/common/ip HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: abee6a4f68c2d418f2c53c29b2efe447\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04VRO197:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04VRO197_29158-31944\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":706,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":902,"timings":{"blocked":364,"dns":0,"connect":25,"send":0,"wait":482,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01h35d659vlm3svnfo699txh2w.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.873Z","timestamp":1789268708873,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01h35d659vlm3svnfo699txh2w.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:09 GMT\r\nContent-Type: image/png\r\nContent-Length: 835\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:06 GMT\r\nETag: \"5ea73311e50d0821f55a560d6778d983\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e5_PS-CDG-04uki195_56153-3251\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":835,"size_decoded":1266,"mime_type":"image/png","magic":"PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced","md5":"5ea73311e50d0821f55a560d6778d983","sha1":"0764061f2064031557a943ebec8ab77ee5b74e60","sha256":"846130eadd4deb84f54cd9ded05b9f5f772050dc6b25bc1b2b3ff839526b986b","sha512":"3388477be52d0d998331c4eddf94250569fcbb990be2f8d79117bb6b2428d7174bba7527ac7f21bfc8ba761846095e86a8a4e2061330418cc07b1b58b3b02768","ssdeep":"","tlshash":"04018a97f91ec035ef0d5f51342702d3f5d47449752c26184034085e7c5d3284d95729","first_seen":"2026-06-14T14:24:21.191391Z","last_seen":"2026-09-13T03:05:55.796998Z","times_seen":43,"resource_available":false,"data":null}},"time_used":158,"timings":{"blocked":130,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/sys/logo","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.798Z","timestamp":1789268705798,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/sys/logo HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 2c03b48268c2d41830a7b35caae3689b\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04uki195_55446-4885\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":378,"timings":{"blocked":198,"dns":0,"connect":0,"send":0,"wait":180,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/game/gameSubList?categoryId=6\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.358Z","timestamp":1789268707358,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/game/gameSubList?categoryId=6\u0026orderByDim=1\u0026currency=CNY\u0026pageSize=20\u0026lang=zh-CN HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: bc6a2c1569c2d418eec63c29e6c8c8a7\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_55446-4906\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1212,"timings":{"blocked":1033,"dns":0,"connect":0,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00023.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.378Z","timestamp":1789268704378,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00023.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 33800\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-8408\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04h2Q194:32 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04h2Q194_46621-35456\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33800,"size_decoded":34445,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"9988a7fbacef38e4b07b53731e0d12f4","sha1":"6cfaf30cd274d5f994b6d13f9aa95f3f633d9128","sha256":"de22046b656b7d137d4207a59a006e7f2390f087e78a189ae2e435e1442194b6","sha512":"a7316f403e255f43510939c476ba8ba29234d0353f080fd8ef58c096d479dcf1765ff137dd37b1d9489e7bf576fb78279b82871f7d2c384c5e52ffe122eaccdf","ssdeep":"768:lmv2iIhZQGegq13j1h4BeBNP1i8Xc8UeE9mWs0BHxMhEsfrvZQkrNoDfn:lpLDQGK13jPGe3P1ibSEQGHxMhrfuP","tlshash":"a5e2f1bee6a0fd1368ed48f01b34a8540566064e57640bf26cae3e045a5c12fa1d9fcc","first_seen":"2025-03-14T20:40:58.546629Z","last_seen":"2026-09-13T03:05:55.797641Z","times_seen":116,"resource_available":false,"data":null}},"time_used":2365,"timings":{"blocked":2182,"dns":0,"connect":0,"send":0,"wait":178,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlrrgkooi3dj0phdj9v.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.321Z","timestamp":1789268707321,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlrrgkooi3dj0phdj9v.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 71326\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:54 GMT\r\nETag: \"d2853f1d6fe91dbe22339115884689b1\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33032\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":71326,"size_decoded":71759,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"d2853f1d6fe91dbe22339115884689b1","sha1":"2acf7a6427c727d34c06dac0cc8a54de0651d503","sha256":"d6b4477fa5ec1fe758b6b2966217b53c6ce943a43222a4f7241d307007ac54dc","sha512":"50b90145c92eed4ab12d68db2a1aafce232028225da311cc6d77f4dcf1bb8e75362fb26871d9d8b9fc99699a6ad75afbe2f8b30c4951494470378c93a1f01021","ssdeep":"1536:cGOlnPt1HjwfHFACR8kKOGdDMRVtBhAhYvZaUjWquwB:cGOlPtNjwfFA68hMPhaCZaUXfB","tlshash":"5763027d91fd92c8767c83fdc726dbeb341e23e31e251a63859c2096c8642823e498d9","first_seen":"2025-12-11T02:11:47.262556Z","last_seen":"2026-09-13T03:05:55.798376Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1244,"timings":{"blocked":1211,"dns":0,"connect":0,"send":0,"wait":27,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/right_invite.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.783Z","timestamp":1789268705783,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/right_invite.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/png\r\nContent-Length: 45489\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-b1b1\"\r\nExpires: Tue, 13 Oct 2026 03:05:07 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:8 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23238-37995\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":45489,"size_decoded":46133,"mime_type":"image/png","magic":"PNG image data, 162 x 240, 8-bit/color RGBA, non-interlaced","md5":"20463ae1f3f3f87e5cfc81a73aeb5295","sha1":"78a27f3b6ab67741d6e6d2ced47cc944de683bfb","sha256":"5c875eebf8c68d7b858c78c90e55be8b05ee58ae05e7501917c10af34c35f05e","sha512":"0833d78cd47f837b3d7335803451d75dc5f5f316cb89e6910aa067914eb458297eb46d1fcc4d4db26dca1df3b7c2ffacc8b811ee4bc8f7b74c7ecaa55c7fa7a6","ssdeep":"768:zicoy6LT0RPilTmZTQHLJ10bLAKEUkUTRqHX7X1FMbgKb1:+bX0RPilqZkHLJ69EUkUTRIX1FMbgKJ","tlshash":"4013f174d8de48de6528bd3d5a3e54ed1f3b01b424db29888728e601e1052a53de7d3e","first_seen":"2026-06-11T02:30:28.082788Z","last_seen":"2026-09-13T03:05:55.799114Z","times_seen":70,"resource_available":false,"data":null}},"time_used":1358,"timings":{"blocked":1179,"dns":0,"connect":0,"send":0,"wait":176,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedllfjkdvow950eyebek.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.338Z","timestamp":1789268707338,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedllfjkdvow950eyebek.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 96316\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"a8794cc5b2f7498c2a46902727f2ff36\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6976\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":96316,"size_decoded":96748,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"a8794cc5b2f7498c2a46902727f2ff36","sha1":"3745b24bfa1db8f58096e95b294cfcc7b228a987","sha256":"17beec8d783413bf9e19609786bd06e7fe7305a1c1c76577ac19987539a18fe4","sha512":"df2c6d0eb78922b3ba654bd11ae0acfafac2939eda75cfd427ea45d5aa834eaaf24f480588b9798baf9419a58881b983332f7365e24f1700d541412917f3cdb4","ssdeep":"1536:Q9SkiCvtVVITeIxWKlu++ZlFeaKOY/fa3hj6Fnq2NNCsQcWPGWg4Xm8Q9JCtGBBL:Un1VVzIEdZlF16fa3FEN5oPE4+a+","tlshash":"659312d9f8dd35df29252cca294b9b8f333d60145dc76f231968830b88b932cea91178","first_seen":"2026-09-06T17:58:09.588753Z","last_seen":"2026-09-13T03:05:55.799678Z","times_seen":6,"resource_available":false,"data":null}},"time_used":1276,"timings":{"blocked":1235,"dns":0,"connect":0,"send":0,"wait":27,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/create-element-if-not-defined-BMi5bvf-.js","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.407Z","timestamp":1789268704407,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/create-element-if-not-defined-BMi5bvf-.js HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 276\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: \"6a9e5e6a-114\"\r\nExpires: Sun, 13 Sep 2026 15:05:05 GMT\r\nCache-Control: max-age=43200\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e1_PS-CDG-04VRO197_23850-31923\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":276,"size_decoded":929,"mime_type":"application/javascript","magic":"Java source, ASCII text","md5":"b7e0c1906b67ada7c7d27c641da1e6c9","sha1":"e1d07129d2c850e2262516e14bcab3a3a9a2416c","sha256":"703997cc197eef36a7e9c033370bbd2bb0ae8bc6e02e4f3040ef632397222e67","sha512":"e4a7bdb339316b779eea4d900261ec962c803d08c7a233ec8dd7bdd7d99d532afd69c0e22827d80ccfb49a016492c6e9b0cfd3ca83ad267e8ccdc404e6c57a59","ssdeep":"","tlshash":"05d02b595033907409fe056e04da5e07e15366ba272157147063df7496e89e28a0fd0a","first_seen":"2026-09-11T22:02:29.348419Z","last_seen":"2026-09-13T03:05:55.800211Z","times_seen":4,"resource_available":true,"data":null}},"time_used":752,"timings":{"blocked":566,"dns":0,"connect":0,"send":0,"wait":186,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/match/getList","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.429Z","timestamp":1789268707429,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/match/getList HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e4_PS-AMS-04DYH56_28018-9795\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":441,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":1302,"timings":{"blocked":1064,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1tonddzkv1epg9ap4u0jt2s47.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.256Z","timestamp":1789268707256,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1tonddzkv1epg9ap4u0jt2s47.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 46726\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:25 GMT\r\nETag: \"3b1e30271dbafbfbd34f8f43865ead64\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_1027-2137\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46726,"size_decoded":47159,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 448x600, components 3","md5":"3b1e30271dbafbfbd34f8f43865ead64","sha1":"520fc5019fb9dd7a7b7086e48662f0acc571d164","sha256":"a2afddc8b82698d5e09b0683ce9b4cf558380c585676ea1986da42c05f2ec596","sha512":"b97d8b466536472c0ea149c600c532b27afaef6fc553689bdbeb83c5c89deee68dd69d3df0eabf40c24d1fae5ed1d41c1ecbf1e7439c942ea43b73fab714705d","ssdeep":"768:n5h6jMnWPDN3xfMoBbBCFGnMtL8aN9qXYsZZGjM5VHu+URyslPlHQKrazaWh:n50YIuybVMtLXyYsjGIW+4yYlHQfaWh","tlshash":"c123e0b9b7f1a086c983c4321130a3b81162fba2e6d2761fd69ccfd871861e4d67f154","first_seen":"2025-12-11T02:11:47.16054Z","last_seen":"2026-09-13T03:05:55.800745Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1035,"timings":{"blocked":1004,"dns":0,"connect":0,"send":0,"wait":27,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.a8z2.com/v1/merchant/detail","fqdn":"api.a8z2.com","domain":"a8z2.com","tld":"com"},"ip":{"addr":"153.43.67.52","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:06.974Z","timestamp":1789268706974,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.a8z2.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 25 Aug 2026 02:12:35 GMT","end":"Mon, 23 Nov 2026 02:12:34 GMT"},"fingerprint":{"sha1":"E2:DC:99:2C:81:A2:96:C9:58:B2:4C:27:91:11:11:BE:D0:52:4F:98","sha256":"CF:55:1A:79:68:50:AD:C4:DA:25:07:96:12:91:1C:0F:CD:1E:22:CA:C9:83:70:2F:D8:87:75:15:CB:B6:34:E3"}}},"request":{"raw":"OPTIONS /v1/merchant/detail HTTP/1.1\r\nHost: api.a8z2.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 \r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, PUT, GET, OPTIONS, DELETE\r\nAccess-Control-Allow-Private-Network: true\r\nAccess-Control-Max-Age: 3600\r\nAccess-Control-Allow-Headers: content-type\r\nCache-Control: no-cache, no-store, must-revalidate\r\nPragma: no-cache\r\nserver: nginx\r\nx-req-id: 6aa612e3_PS-AMS-04DYH56_35724-11813\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":442,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":368,"timings":{"blocked":-1,"dns":44,"connect":22,"send":0,"wait":240,"receive":0,"ssl":58},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un1m5sddveaj23kecey00cb38yr.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.213Z","timestamp":1789268707213,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un1m5sddveaj23kecey00cb38yr.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 67388\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:20 GMT\r\nETag: \"a818f312157f81e7d217d0ea7ddc5e46\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6959\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":67388,"size_decoded":67820,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"a818f312157f81e7d217d0ea7ddc5e46","sha1":"10b88f2280835dba5a5a1b57802f0fffdac3393e","sha256":"c446977dc8f5b086993ac8b879913858649654669a1298433008dd464b60fdfb","sha512":"6d4a6f3efc07842a2553058ea10718ab9cce4ad928a1fae3bcf98e661d8e04f87ee8054355321a4fbae10e1f8e8ef024828c85c884042f6afbedb86cf79e5509","ssdeep":"1536:eISbFtarG5ma4QKn0ocI0/J0tCJs7mo63u3P9cpgS7V:1SFtarl0ocI0ues7mt3uf9cpgS","tlshash":"85630228b6419d2cc5a703bba50a5b95e206bd9b7f8731136d717607290fbfcf0e2560","first_seen":"2025-12-11T02:11:47.316877Z","last_seen":"2026-09-13T03:05:55.801329Z","times_seen":41,"resource_available":false,"data":null}},"time_used":956,"timings":{"blocked":924,"dns":0,"connect":0,"send":0,"wait":27,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055uncsifdej51c268wunuc4d5zgj3.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.281Z","timestamp":1789268707281,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055uncsifdej51c268wunuc4d5zgj3.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 27145\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:58 GMT\r\nETag: \"a2d12e2c50f1c587a226de7ed4bec216\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:14 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04uki195_56153-3233\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27145,"size_decoded":27579,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 448x600, components 3","md5":"a2d12e2c50f1c587a226de7ed4bec216","sha1":"a0b7f9ed498e2d6702acd05cb14c339f4b34e279","sha256":"79c13ac591404ca004eb4e8e34283d34e94dd0f0e4e4758271436861e53d24c3","sha512":"9d466f5bccfb4617a46ff405e49d05673ba6bbc466a298dc908acdb4d34e998494fe0fa96a8369c14f28d1245ee9ae4e55d2f46986969bc1b16b187f7072f9a1","ssdeep":"768:elwGhycpaeJHinGxBcIV1GLDNVWO1b+JVbE0:ghDaSinGxuIVsLTWXVbl","tlshash":"eec2d056f7f942e6e3e96a7142bf1202c3829472627ecd8e300ce2d506cb3561db0578","first_seen":"2025-12-11T02:11:47.338946Z","last_seen":"2026-09-13T03:05:55.801975Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1098,"timings":{"blocked":1068,"dns":0,"connect":0,"send":0,"wait":28,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/zc5scx01syndcuqfnluufm7do09z1yry.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:08.843Z","timestamp":1789268708843,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/zc5scx01syndcuqfnluufm7do09z1yry.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 6514\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:19:09 GMT\r\nETag: \"bf3ebb41acc167267034daacd7038fca\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04koU196:2 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04koU196_38874-6979\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6514,"size_decoded":6945,"mime_type":"image/png","magic":"PNG image data, 400 x 200, 8-bit colormap, non-interlaced","md5":"bf3ebb41acc167267034daacd7038fca","sha1":"9853e15a801c77e3cbb571549d447f2dd3c6f7b4","sha256":"0604dfd551eb809fc4676fb82a12805e97b5f3619220b09be2c5b0cfe314a1d4","sha512":"4783a7c08af0140e89dac9a701595af325916392e6920d9869e079099b853155e1f10a647e99216984d96f04b775d662a0e34b7fd358443ae0de45cd412d9cb7","ssdeep":"192:dx1tg8v7Eox5i/d6V/AL7snxnf59cXRMZs:dntgMw/IVHVzcXRMZs","tlshash":"b8d1b0e02804498df0442ffa8ab96936a9bf605082c8e1b7304d7df83e5006fa475f75","first_seen":"2026-06-14T14:24:21.287964Z","last_seen":"2026-09-13T03:05:55.816452Z","times_seen":43,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":11,"dns":0,"connect":0,"send":0,"wait":27,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/?agentCode=sxkngs","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-13T03:05:01.886Z","timestamp":1789268701886,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /?agentCode=sxkngs HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:02 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:49:14 GMT\r\nETag: W/\"6a9e5e6a-144e\"\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612de_PS-CDG-04VRO197_24105-30041\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":5198,"size_decoded":2925,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1632)","md5":"8272bbc43fb1a60eebab17248e67a4ed","sha1":"a7a3044b6a3d7e2fa9646d909faa446ba7feac5d","sha256":"ec45b26d9bae28b8adcb2cd1982da59217677732608f77c2b8016fda830bf293","sha512":"caeba6e806b206f04e3afce0cbba0b6a5f95a24c8d2a741dc65e5ef7d4fd30cef87ae7ee42a4d67bff28079b8ac8c971e2fbb0d380e699ea2fbb9bd28ea7da61","ssdeep":"96:zKsYLeaxLD/nEAItkhYFuWnHcigdmtsBH9FxgzzZhCZydHRH/ISquB1piH2iH4HQ:ebf8AgkhorHcfEyZ9FxgeZCxfISquB1c","tlshash":"e9b1c86b2c74865c0666257af97bfb0c357121128478d800799dc0ac1f64fedc99aede","first_seen":"2026-09-11T22:02:29.317484Z","last_seen":"2026-09-13T03:05:55.817628Z","times_seen":4,"resource_available":false,"data":null}},"time_used":447,"timings":{"blocked":-1,"dns":242,"connect":26,"send":0,"wait":179,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/image/invite/invite_00028.png","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.384Z","timestamp":1789268704384,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/image/invite/invite_00028.png HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/png\r\nContent-Length: 38948\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: \"6a9e5e56-9824\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nAccept-Ranges: bytes\r\nx-via: 1.1 PS-CDG-04VRO197:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_23850-31937\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38948,"size_decoded":39593,"mime_type":"image/png","magic":"PNG image data, 560 x 504, 8-bit colormap, non-interlaced","md5":"2a2671deebb05dc1966bbb94416d7de6","sha1":"76dd0e18a7d9dfdbdd9d7d1ba7441eba2027723f","sha256":"e7773bff1530f33085f04bf9a90c8c1b36f8b933e6fe78abe88434fa0748ced8","sha512":"e810b2e7398e124b30cc5e8e0bb345e178279f1c8fa6666607a6d447787d510b3e48dac47b91c967c87ff2d67d022a97c75b9ebfe46f11f8e12fcf35148a7f6e","ssdeep":"768:nUKyNgN8uwKBePkoS1SaFx22qGiJNnSZXI3rtzSFrqu8OhxQgf1dgJYy:UT/uNBwJS1Skxxq5JNnOY3ruqu8ODQgc","tlshash":"7603e063d365bb98df6b4df12d9786d0a6b91f7df6380f0581db149a838a22cd100a0b","first_seen":"2025-03-14T20:40:58.403412Z","last_seen":"2026-09-13T03:05:55.8185Z","times_seen":113,"resource_available":false,"data":null}},"time_used":2440,"timings":{"blocked":2252,"dns":0,"connect":0,"send":0,"wait":187,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un3c8fdedlmmv2mogba40l3wwqr.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.327Z","timestamp":1789268707327,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un3c8fdedlmmv2mogba40l3wwqr.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 95710\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:53 GMT\r\nETag: \"b3796397b6f9bb343adf86b03bc3bbe3\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:1 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22295-30822\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":95710,"size_decoded":96143,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"b3796397b6f9bb343adf86b03bc3bbe3","sha1":"0880864fb0ba5dc3891628c9554f05a925678d8a","sha256":"e35b05ac447a91a531af305f27fffd2140be6fb1d268b0272f2c6122cea9062e","sha512":"e9cb869f7fd7086b3ce4728df0f66b53680465842c120feac25aa0fdce8bcb3f899a2894ddd35e9063196f7756aa2d5242bde2219513edcc8b2d9a2290c6b09e","ssdeep":"1536:uANR4nAFi7JU4GwtO8YK7uacYkB0I0HxRr/xYWuV0mRyuuM+QXgJO7bDaIanpEPp:hR4AFis4htlYWuV0mRyTuAnGeF1kF","tlshash":"519302830c56c23da47a7e753b92a9d0e91e4f166c8fd49437f4cada84303c799bda21","first_seen":"2025-12-11T02:11:47.179985Z","last_seen":"2026-09-13T03:05:55.819308Z","times_seen":41,"resource_available":false,"data":null}},"time_used":1263,"timings":{"blocked":1227,"dns":0,"connect":0,"send":0,"wait":27,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/channel/g9kdwd056cidior191b62zanvqbgvh3o.jpg","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.163Z","timestamp":1789268707163,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/channel/g9kdwd056cidior191b62zanvqbgvh3o.jpg HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:07 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 335532\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Thu, 21 May 2026 23:45:53 GMT\r\nETag: \"512a71ad97295d495b57443b353d8a1f\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04uki195:30 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e3_PS-CDG-04uki195_1027-2125\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":335532,"size_decoded":335966,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 2400x500, components 3","md5":"512a71ad97295d495b57443b353d8a1f","sha1":"46318b5e3e9f2d03d67be575bf0e69cd87e37153","sha256":"dc380650730a88885b78f6d8e3161c52b7d3dace9db61e53e34b1687b8a8968e","sha512":"3d52f3e4db94e38113d4a9ef511c6b6ab1247a91df226096bb77824c8bc5ef91084c6b056862bc2bee0e38cf1d44e924b86a81153f6c3baa6c9de35d37e0343f","ssdeep":"6144:PIJ4QyvQLSsxgz+o6hAoSaltNA4pWa2cgujMrQVz9ntD4kI:PFQ6QLSsxqj6hAonXNA45guQAt8kI","tlshash":"b16412850b6b3eb345d97a25ad4c30257883ee3cc0c44eb9a2db717b92d370d13965b9","first_seen":"2026-06-14T20:28:34.282527Z","last_seen":"2026-09-13T03:05:55.820085Z","times_seen":37,"resource_available":false,"data":null}},"time_used":935,"timings":{"blocked":-1,"dns":753,"connect":26,"send":0,"wait":27,"receive":95,"ssl":32},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"uapi.9tudkcx.com/uapi/user/reqDomain","fqdn":"uapi.9tudkcx.com","domain":"9tudkcx.com","tld":"com"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:04.419Z","timestamp":1789268704419,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"uapi.9tudkcx.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 21 Aug 2026 22:07:08 GMT","end":"Thu, 19 Nov 2026 22:07:07 GMT"},"fingerprint":{"sha1":"83:11:45:B5:BE:B2:5B:A7:8F:B0:0F:F5:1F:57:47:75:B6:D1:E7:A1","sha256":"38:9B:F9:FA:23:E1:C0:BA:F7:07:E4:E0:BA:53:FD:52:4A:E0:EB:F4:52:14:06:8A:1B:4C:F1:C8:02:59:88:7F"}}},"request":{"raw":"OPTIONS /uapi/user/reqDomain HTTP/1.1\r\nHost: uapi.9tudkcx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nReferer: http://www.qq071.top/\r\nOrigin: http://www.qq071.top\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:05 GMT\r\nContent-Length: 0\r\nConnection: keep-alive\r\nServer: nginx\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Headers: Origin,Content-Type,Accept,User-Agent,Cookie,Authorization,X-Auth-Token,X-Requested-With,app-theme,app-type,app-ver,content-type,lang,x-cq-sign,x-cq-ts\r\nAccess-Control-Allow-Methods: GET,PUT,POST,DELETE,PATCH,HEAD,CONNECT,OPTIONS,TRACE\r\nAccess-Control-Allow-Origin: http://www.qq071.top\r\nAccess-Control-Expose-Headers: Trace-Id\r\nAccess-Control-Max-Age: 3628800\r\nTrace-Id: 9ba3d05268c2d418e3a6b35cdb12ea2d\r\nX-Backend-Time: -\r\nx-via: 1.1 PS-CDG-04uki195:11 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e0_PS-CDG-04uki195_55446-4880\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":718,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T04:24:29.959044Z","times_seen":18436735,"resource_available":true,"data":null}},"time_used":958,"timings":{"blocked":425,"dns":0,"connect":26,"send":0,"wait":477,"receive":0,"ssl":30},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"uapi.9tudkcx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"http","addr":"www.qq071.top/assets/icon/result.svg","fqdn":"www.qq071.top","domain":"qq071.top","tld":"top"},"ip":{"addr":"174.35.102.98","port":80,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:05.775Z","timestamp":1789268705775,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/icon/result.svg HTTP/1.1\r\nHost: www.qq071.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/home?agentCode=sxkngs\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:06 GMT\r\nContent-Type: image/svg+xml\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 07 Sep 2026 06:48:54 GMT\r\nETag: W/\"6a9e5e56-71e\"\r\nExpires: Tue, 13 Oct 2026 03:05:06 GMT\r\nCache-Control: max-age=2592000\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With\r\nContent-Encoding: gzip\r\nx-via: 1.1 PS-CDG-04VRO197:12 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e2_PS-CDG-04VRO197_24105-30068\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1822,"size_decoded":1295,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0406cda167e35f2d072c79980cad094b","sha1":"2694cbfbe12557e0f604f715937cf6f0e0080184","sha256":"091e16576fb1739ca540926fc6d884a8f809c27151ee843dd9252a47edf6d7e0","sha512":"085e5e84385e7d9b727da13eef7b9f51cd15df1b2958b1e2078a1818c39a8c699295fe54f0a579c3b1ced6c61f9469f786dbba338fa2544e51b404f2e11fcf37","ssdeep":"","tlshash":"2e31afe6a5fc09095a058341fbee95a8432cf29b161611dc738c30a6cf384ba37af559","first_seen":"2025-08-30T23:50:55.989131Z","last_seen":"2026-09-13T03:05:55.820806Z","times_seen":111,"resource_available":false,"data":null}},"time_used":671,"timings":{"blocked":493,"dns":0,"connect":0,"send":0,"wait":178,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-13","alert":"Sinkholed","trigger":"www.qq071.top","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s.mng28.vip/pub/game/1m055un2cv2de9tje6ez26dk3036i4c9.png","fqdn":"s.mng28.vip","domain":"mng28.vip","tld":"vip"},"ip":{"addr":"174.35.102.98","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://www.qq071.top/?agentCode=sxkngs","date":"2026-09-13T03:05:07.232Z","timestamp":1789268707232,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"s.mng28.vip","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 11 Aug 2026 15:33:32 GMT","end":"Mon, 09 Nov 2026 15:33:31 GMT"},"fingerprint":{"sha1":"E3:88:53:92:B0:E9:89:CF:54:86:EE:B7:84:0E:79:F0:6E:53:18:45","sha256":"B5:33:73:55:CF:13:F2:37:17:01:1E:D9:57:A9:E4:A6:75:97:D8:E4:37:54:86:78:C8:FC:36:9C:EE:BB:B3:C1"}}},"request":{"raw":"GET /pub/game/1m055un2cv2de9tje6ez26dk3036i4c9.png HTTP/1.1\r\nHost: s.mng28.vip\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://www.qq071.top/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 13 Sep 2026 03:05:08 GMT\r\nContent-Type: image/png\r\nContent-Length: 93861\r\nConnection: keep-alive\r\nServer: nginx\r\nLast-Modified: Mon, 16 Mar 2026 13:18:45 GMT\r\nETag: \"e5ff09cbafd371146cea130111560c24\"\r\nAccept-Ranges: bytes\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: max-age=604800\r\nage: 1\r\nx-via: 1.1 PS-CDG-04VRO197:5 (Cdn Cache Server V2.0)\r\nx-ws-request-id: 6aa612e4_PS-CDG-04VRO197_22838-33021\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":93861,"size_decoded":94294,"mime_type":"image/png","magic":"PNG image data, 448 x 600, 8-bit colormap, non-interlaced","md5":"e5ff09cbafd371146cea130111560c24","sha1":"f9872c4bc455431bc3965733a097089709106f22","sha256":"a9d1c5940765b6e01292433b7f217eedb6f7352a2133b5815165fda921d25ae1","sha512":"b5e6146bd9892e40348f084729eb74ab8f32abb69e2dcaae9bdb7c141e1f33ee69dd82d5bf4960e50567fd47d0453dd535115899ca4c47bee4793bd7a10452c2","ssdeep":"1536:t6xlwg26SSj7S8NxW8aXWv7FHeVoVYByspmnI7/mBhcBjGjnQWE2qlEJ9rMHs0uw:t6xlwg26SO7SSWTXS7F+KH6qrcCQWE2w","tlshash":"8f9312933edcea428bc2131f060d6c8fdd4ed1e01657285547686a60b3972a4e2df367","first_seen":"2026-06-14T20:28:34.293621Z","last_seen":"2026-09-13T03:05:55.821609Z","times_seen":37,"resource_available":false,"data":null}},"time_used":981,"timings":{"blocked":946,"dns":0,"connect":0,"send":0,"wait":27,"receive":8,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"s.mng28.vip","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}}]}