{"report_id":"72fe632f-07d7-4b86-acdc-7176e19f23ff","version":6,"status":"done","tags":[],"date":"2025-11-04T05:20:26Z","url":{"schema":"http","addr":"www.6789c1.net/","fqdn":"www.6789c1.net","domain":"6789c1.net","tld":"net"},"ip":{"addr":"104.21.16.134","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"title":"6789 ỦY QUYỀN CHÍNH THỨC DUY NHẤT","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":""}},"submit":{"url":{"schema":"http","addr":"www.6789c1.net/","fqdn":"www.6789c1.net","domain":"6789c1.net","tld":"net"},"ip":{"addr":"104.21.16.134","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"country_code":"zz"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-12-09T05:20:26Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2025-11-04","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"www.6789.show/js/encrypt.js?v=13424","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"www.6789c1.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"images.5949390294.com","ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-05-05","domain_rank":620088,"first_seen":"2025-05-28T20:51:42.974673Z","last_seen":"2025-11-02T09:33:06.588902Z","alert_count":0,"request_count":241,"received_data":1940893,"sent_data":114374,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.gstatic.com","ip":{"addr":"142.250.74.131","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":146047,"first_seen":"2012-05-29T15:36:17Z","last_seen":"2025-11-02T22:15:49.745695Z","alert_count":0,"request_count":2,"received_data":210815,"sent_data":927,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2025-11-02T22:15:46.374949Z","alert_count":0,"request_count":2,"received_data":288220,"sent_data":923,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.6789c1.net","ip":{"addr":"104.21.16.134","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":1,"request_count":1,"received_data":2782,"sent_data":483,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"images.5324242.com","ip":{"addr":"104.18.24.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2024-09-02","domain_rank":3143953,"first_seen":"2024-12-20T12:37:12.187442Z","last_seen":"2025-10-30T04:45:59.46578Z","alert_count":0,"request_count":1,"received_data":100374,"sent_data":508,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"www.6789.show","ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2025-09-16T05:18:55.181004Z","last_seen":"2025-10-11T14:45:13.521934Z","alert_count":1,"request_count":79,"received_data":21169494,"sent_data":44460,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdn.jsdelivr.net","ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"domain_registered":"2012-05-16","domain_rank":1678,"first_seen":"2012-09-30T00:15:09Z","last_seen":"2025-11-02T22:17:55.857863Z","alert_count":0,"request_count":4,"received_data":1072011,"sent_data":1781,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"xukqq.6789.show","ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2025-01-15","domain_rank":0,"first_seen":"2025-11-04T05:20:36.328871Z","last_seen":"2025-11-04T05:20:36.328872Z","alert_count":0,"request_count":1,"received_data":3076,"sent_data":497,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/numberSeparator.01b17b54.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"01b17b549ad285136b8cb7ec0c7ec291","sha1":"7c721fd5c8da887f7c067a488d88f5fa538e3029","sha256":"959a2c44941d0318df9e0a3776c30393f74d50c9e46d113ea911360c49a621d5","sha512":"296a7cd6d1d6741ca17d884989669b2563ff352143111629947c93892d784738d772de8a00ea99d6c2758f13065e775ab232be33fa7020f7dc4493c2a6372db2","ssdeep":"","tlshash":"d0217d5836b700124d7fb0e98b8f52025b2126577484da8fb62cda947f02c2be2d36fd","size":1318,"data":"","first_seen":"2024-04-23T23:35:41Z","last_seen":"2026-05-31T04:40:23.088765Z","times_seen":2110,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/assets/chunk/GIFT.Pam_fORI.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"6851acd306cf3dbdc40823c829d6199d","sha1":"d2925c8057e00ba1f0d23ee1b18ac0643d5711cc","sha256":"a9c33ca4ecded6e675ff76be1503ad875b9d74a750108e452f2aaee368a5ad3e","sha512":"a34c07a5f3a260523b7f7b4447a810fe69f7ac6ea820a1f428c6c4597d6ece419cc1d67b91238de5ed028b4955212911dd656c3ae4cc43721a1076880be3ba75","ssdeep":"","tlshash":"b0b0120714a5ca18482271c401789657b2094b10743515544048454237a3d2400409b0","size":92,"data":"","first_seen":"2024-07-11T14:40:28Z","last_seen":"2026-05-31T04:40:23.083052Z","times_seen":2111,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/qrious@4.0.2/+esm","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"3f0602cee23a7b0377062a1a341d01b1","sha1":"1460e5e4ecac325960633e79118c96829f1df85d","sha256":"8478c77637d268ea9f88e1aae84dacd031256fb67063a8d94d222cd3eff8f84c","sha512":"7c1c6533f0e924a56239bb1395f6d4fd26cb9e718e355fc5448008da6fa6ca980d9a57e6d427e71e751cb66120dcfe5af1ce80d6b093d5336ab82ea63c0b9dec","ssdeep":"192:NMSJOPXg7hZv1fpYoE8GS9GLhgbHcj/13BBenIhG8+f3/pSq3c/WJBS7SEzonxKl:eSJOPX6wl8GfYUfhpfwcqEhwdlmRvki","tlshash":"a182859673a19269639669d5083f244f82f6e4193418429cfbb2c9dfbd3c4c96039f3a","size":17820,"data":"","first_seen":"2025-04-04T11:34:30.82088Z","last_seen":"2026-05-31T04:40:23.089257Z","times_seen":1923,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"4164780dd9672b5e5a028b69fa19255a","sha1":"348dff18cf65e28c60e3db6488ed296ef626f71f","sha256":"f40767208d713cca94958978300740dd1a430e68e2e61e4205d0722e5319754b","sha512":"6113cc4210ebfb69c22ce9d9cbb3f0c9839dfdd4138c602370047330098477c97dbef999f4e73c290afa0649ed4483e8a499b42d0674833201996ed7c6999a5e","ssdeep":"","tlshash":"69a0220302fc082320083800a0c80282c8080fe202222c022020032b08b08a00303f2c","size":64,"data":"","first_seen":"2025-10-21T06:00:22.204267Z","last_seen":"2025-11-04T05:20:58.558108Z","times_seen":10,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/v.1.0.1/lib.js?mc_t=shanshan\u0026ac_t=shanshan\u0026version=v.1.0.1\u0026ac_v=1.0.1\u0026mc_v=1.0.1","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3aad2612dfcd43b8dfed1ca072aa5c21","sha1":"d3d97c5ae4454416d627ad3e9c5ed7856085b981","sha256":"8da0cbe25140dff92f08b7d1ecebd3da8c2f47c9d414dba6cc5bdcb4f7006de3","sha512":"206f426ea79f4ae420686a5a40e2ecf9ccabf1b6970a125ddc66ccb65e584c089622163fdc4ef94054734cd0869a2d1090fb66980418de0b23887aa0805d229f","ssdeep":"96:fYr5C14peqd/VyZ2N+dE+sf14D55gBmBEZQRZlgPhanvxiKLKH6aDVAG0:S5C1G/Vy8Id5n7gBmMQ/nJiGWVAp","tlshash":"1dd1504d7525f494a2c7a1a4c27f5c0fad37246e2829c034f5c1e9e2ad78e4d812bf5a","size":6486,"data":"","first_seen":"2025-06-14T14:10:40.274801Z","last_seen":"2026-05-31T04:40:23.135947Z","times_seen":1901,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/html2canvas/1.4.1/html2canvas.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d7530aa0b7587e627484c49fdf8f13f2","sha1":"b987dc0cc6cfcdc2e34499375f505470c5adb891","sha256":"e87e550794322e574a1fda0c1549a3c70dae5a93d9113417a429016838eab8cb","sha512":"04d6914276096223d2a871c36f9f01d3268f7c2bbe5a076cf06a7f814df792a06d80d4b8b523c7b8689bca87aa315fd326548a75ae855f3a04c981a34defaf5c","ssdeep":"1536:dLkw5M8eKEsqi5xpg+n1sPMecC9JmgxBQSFkkZQRlNM7IgeXzh:dLUtZSpg+aZmabZQz9","tlshash":"121457b46ba71cde0a7ef49b00172d838d981b67117fd1e8f24aada62d70702ceb1574","size":198689,"data":"","first_seen":"2023-03-08T20:20:59Z","last_seen":"2026-05-31T04:40:23.225817Z","times_seen":5966,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/assets/chunk/CASH_VOUCHER.Cn0Y36G3.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"9e7feb8066f3d589458b5e905a356638","sha1":"af4ef890c2778b4930f769e48b8ef62e4ad22b5a","sha256":"1954786bf71459c5b7b08104275b89aba32f836971d3608ba243cfa75fea9fbd","sha512":"069db298dcd6629c546d8073c5e55f9fba28963c6c888ccdbd5c40268d2b5a8a907d801d37c736570fa584973eb01ef87674ea7def6ce24433edcd575cd71ee9","ssdeep":"","tlshash":"e3b0120154a4c216500eb30d5168d15e3e12af18bd2910e8804c950273d790584105b0","size":99,"data":"","first_seen":"2024-07-11T14:40:28Z","last_seen":"2026-05-31T04:40:23.139249Z","times_seen":2110,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/mc-properties.2d991a82.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"2d991a8242e4d19ee8607f39e8ced8ef","sha1":"e911ed80d9beaf804eafdac2162e5fe93c83ee44","sha256":"65f4f4ea113e155469ee151597b2a41cd5c1ced31a5c9fb7739f43e5635904e5","sha512":"c5153a3a464faefc46ef39f3dac3cb3594fde03f23734a045173f819542951549da2f0d31bd2d8d169fcb3714f3736542772aca7c29ab0554535b83ef485162a","ssdeep":"12288:z6/sPs7w0NpmKE5Fe1b2gBWMCfX6hCwBCFTwbWyP8Qyam7z2JG+XnMS1lZE5wemO:z68JFeM2MhgRDT4BM1gFVdKtM7RrUY","tlshash":"13c5e6c80e6fe595c8ee6607708e7a3040e87d229aa5d7c1de6e0fdd45c8d7c821276e","size":2597474,"data":"","first_seen":"2025-10-31T11:25:46.489986Z","last_seen":"2025-11-04T06:26:26.795319Z","times_seen":27,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"e6c2415c0ace414e5153670314ce99a9","sha1":"5a9eeac34d86e92e5660e0f4f87204f1ed0c8ff6","sha256":"d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8","sha512":"de027062931edd07b01842eff24fc15fdbdcaa1af245dcd133155faba9e0c965f0a34dc6144ce3b149bc43b4597073c792cb6dabbfc6168c63095523923bcf77","ssdeep":"1536:/KRUXRa8Dgwxcy2jpBNwch96SLk8Ek2BSrBGS1ia/eEk4aV2EXi8SMpQ47GKV:/u1zNwcv9qBy1HOg8SMpQ47GKV","tlshash":"9f83f8df77ca702247ab30b9006f550bf276199d684d4400f259d8e9bc78a4a823bf7e","size":87462,"data":"","first_seen":"2023-05-12T23:07:48Z","last_seen":"2026-05-31T05:23:14.007082Z","times_seen":28371,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/numberSeparator.4c2c3f06.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4c2c3f06d44e4213e043745be268fcba","sha1":"26e2182e6c523daf6baaa88679c8510818861efe","sha256":"a2dda5bf0fc34c5f9d6c10b4ea537a5146d3d7a0e7ca6eeb1daa79e4816430b1","sha512":"e5a0e22d1aa5ad675d44dc65a69e340e4de442999ba97b54ecb519bc35174326cd0d63f2f8cf7f82335fab7fd5a5b3e73cf9c3532c4be74752e7ed4c0ab5d1e4","ssdeep":"96:GIOVuXQTvvHfyiwCJd+SYgyquFWqSqyEcdpy5FMRS/bEonL7mOKVrxYdEB0:GIOcXYF1JJYTqGCqyZy5FtjEoUtY60","tlshash":"7fe1df5d72e721728a3f30aa5bdb80016531255bb088d9897b1ccf44af52c79d393abe","size":6905,"data":"","first_seen":"2025-08-29T06:24:26.70014Z","last_seen":"2025-11-04T06:26:26.69521Z","times_seen":486,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/slider.d420e4d3.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d420e4d388935ca74419f5edf6a4b3a8","sha1":"bacc1d0c5ab9314441b2cdf2943a292e4e579398","sha256":"7062323b9c3f6fbc07887ff7baaedb379d6836e7bfe70d7747025729598ab49f","sha512":"1669328f8a562f8be4195a3f484b2167f031d539fd07ae2d8566844e8d49f414438f0307dfb992f0286cbf2beda3fca20b11f5dacd8fe65b6bb96c064c4985df","ssdeep":"768:gXE3sT/57tbDWuZMiRPidEB5Sn55+3WjFQSjWDNGL:gUqWiV5Bm8NC","tlshash":"86e21f0a6bea6570a513b0aa5f5f984a7634419f8d06ed887d5c86c44f0dc3c92f2ff8","size":32272,"data":"","first_seen":"2023-03-07T12:04:53Z","last_seen":"2026-05-31T04:40:23.080702Z","times_seen":2228,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/encrypt.js?v=13424","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"d284e0faa6d9456345ff7b0e4d57083d","sha1":"34f1aa7486dedc202617e5ebc4d70eff4710700a","sha256":"005540cc7f83afd9c9208a5911a8e31cce06e7f6b3f398099aedfda7d87b393d","sha512":"7c6da6250d871e23521588b32781873e1e774777306f32780867eb9b12619da6c2cbe310b72b3324bba5410ab4a016f300de537e27129fafbfe1a1edd49d0f40","ssdeep":"1536:AnVsmjxzHrtaDlfcg9wGxjNQ54neBFxCxCXpaKhKjWCWnWgToXzuAwZVlgpxXhdq:AG5HBASyVT0QK+5NCu+3m","tlshash":"6a63a2502ae03448c3939b79b72b34e1f42d796a78d58c4bf614bf98bf45a13ead1930","size":72066,"data":"","first_seen":"2025-10-21T06:00:22.212029Z","last_seen":"2025-11-04T05:20:58.530651Z","times_seen":11,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2025-11-04","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"www.6789.show/js/encrypt.js?v=13424","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/external-module.cb963217.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"cb9632171bda82b786fbb89531ad45f4","sha1":"1b36a6c329ac24c7adfe0e10959f04f4bb325969","sha256":"b7760263cba6848749e6cc9376f0d4dfc3485878240848a526ef56ebd804327d","sha512":"3474e573bae0212524c2a9d4f3a9f76bf7c6c558d6ce004ec307c589d18228b7cf9a51365cc778022dc8dbed81e0d8e43b5683d9f7ed23f2e12fd88a7ba8a4ba","ssdeep":"","tlshash":"e6e055ab0247e5015d32bfc7f003b161b92a1735aee8a8c2055449b297140a3f2da818","size":426,"data":"","first_seen":"2023-05-26T03:36:06Z","last_seen":"2026-05-31T04:40:23.156066Z","times_seen":2203,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/index.js?_=1762233587030","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3d14b10e2174d6c0a210b099e387b294","sha1":"60705870a1aef58d3c7dff70f68e30ebff9781db","sha256":"885b995b499d93c76cd4d012c59ae4a26fb0c03099d9366cb002d2cb4ec34d91","sha512":"57e05a57c69c2e847f95ee187b1123351b9ce4ce8488a0602fbd987daca8e933ac4a7707dad78069d4090d03f32b21dee307f8f3abbd45647b9d9d579c1cb639","ssdeep":"384:cjOIzhu7En2roI1k/WaHjnFw73LeH+whSwoxzYMNwU30CkCPJi4axcNayjL+4ljr:FsBCg6l5CRn5a+AjwE69e","tlshash":"ca8243562d0f512d0689f5ab78804d6d7eff4ab21ac41d2db2ac8e7cc06d90fa9c93d1","size":19273,"data":"","first_seen":"2025-10-31T03:51:50.08729Z","last_seen":"2025-12-01T18:09:57.810398Z","times_seen":132,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/index.js?_=1762233587030","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1e84b2a5c1671439b2a5fb358e9fec19","sha1":"ffdf1cf1b5a60c28535c2471c50eaa17061e2230","sha256":"ed1fe02315cc904f5327b03e1c773498f76fd7afd0f5c40041d07df4a8da1002","sha512":"b3fb378d243d0c626d427a8c7295cc26488b42df3e8767e1f5c869bd03337e5823fe0a434e3c60760b00bf491d8a6ebb3a0ef831ecb1353707184a7b26948949","ssdeep":"384:ZbhJNKg5/885YHtkLhm4yNHFeEWipjrQ8WFaLjLsu5HNaFrsrwZ7BAhqZ7Wudh+O:xvCdhlljWkPjq1","tlshash":"2b428e170c0e846c168de5bd68654e4c6fef8eb25fc51e2db2ac8a7d052d80f49d93c8","size":12823,"data":"","first_seen":"2025-10-31T11:25:46.376002Z","last_seen":"2025-11-04T05:20:58.431442Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@antv/g2@4.2.3/dist/g2.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"38ac8e4d3bdf9e4d4590f90f572b57ea","sha1":"79225e15d32c0435c4d12847f5ae89bece312add","sha256":"2cea25f3456374b0b3c31f35c6d9b78e638bc26710e8373d9a383ce703c88d4e","sha512":"dcbcdba45f623d55bc6dbb213b120645598396ffb7da40672d32ebed498b6b16788d2e999783e8b27e76c59d18b39ed5d3f4c69fb312b68ae54e4ab48ef10211","ssdeep":"12288:mLSlPBQyGSFzPOMKwnYgNsJsD7AzcFe4zqWf:m2a3IFfX","tlshash":"d215d9a8719078b1829361e8043f050af23ba86d604f65e9f7a5d9f3ac7d84f1076f76","size":885445,"data":"","first_seen":"2023-03-07T12:04:53Z","last_seen":"2026-05-31T04:40:23.098385Z","times_seen":2240,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"8860972a8adab511e18c9fd0cd93e19e","sha1":"1c982c1c5fe92339b744aeffb5235e3ba5eebbfc","sha256":"412fad85e2afeaba5313998cf5b3407ea988fb9d66dc2d3cd6fbfb4b9b5c3247","sha512":"3c7c5f0d0ec3ff3c7675e6d77fca3d46055b7cb85b7715ba0795f92ef5fa7f1ad1461cd8986a0a91a949bc39acece99865f7717f7a7f61749cce013facc842f7","ssdeep":"6144:v/TERPtO7hrpJyfa0pwgrzOuL7c5aCm728p5/ybf7eu+VTm7ETiwf5Gu+:vLstO7dpku8728p5a77WLT16","tlshash":"74d43a8db201746242eb62b5003f1a0ba237552aa40a849cf57ccdde6e7cd4d61bbf7d","size":655654,"data":"","first_seen":"2025-10-29T11:08:15.642559Z","last_seen":"2025-12-03T04:30:52.792265Z","times_seen":155,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/lotto/lott-common/bettingCompress.22844977.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0e9473155c92891f4386dd0d8069e9f4","sha1":"9267afe6b0d97cf53172044ae9a42265d9a3d363","sha256":"a0e031682a12d70795625a3dc3b2ef78cb8e1df947e2624b6af6e4c29f51ee1c","sha512":"fca9d9ce963c1d918968709e1d4cde135d229c86f061ebf6424e7795b0f82a387090afec4e53a14f6b08b4b818bccaade875977c4b9240694221c067b5ed9624","ssdeep":"","tlshash":"e611ab5930c1699a12a2f568c90fb31e54664e2012cae018ca1ed88cbe755fa85a2da8","size":863,"data":"","first_seen":"2025-02-23T00:29:24.577675Z","last_seen":"2026-04-08T06:26:49.892621Z","times_seen":2022,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/qrcode.min.0d19c585.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0d19c5856e872e3f6fb9d0f57bea8dce","sha1":"ce36bde12504b53d0baebd5ee359631cc5172bad","sha256":"03528877abcd8ec6452eac177f2750c551e57632ac2d855ad5bcd6343891bbc2","sha512":"188cde9b65214ec7d1a4508b462c4251bef7e9a1a9d945535d5cb07b1b07ff4e27988b3eaf5a67af999af17b2737ae04412bb1dce122d44f32590a1123ca4669","ssdeep":"384:2IKSnIPLflpMR++8OiXAAdTRZgMvu4nvqqHHHsglNov3m1xk0ZkGULMyzLyURyy2:GmXimr4niqPDzZuiDy2","tlshash":"0392c4e9f35403a6525d5cc5282e644aa4b0b4272c1641acffb5c4e6e8bcfd1b83af70","size":19442,"data":"","first_seen":"2024-12-01T04:34:39.996683Z","last_seen":"2026-05-31T04:40:23.064196Z","times_seen":2010,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"67894759f2a29858696ded34d7a5ad27","sha1":"9c0f3cce7ca31ce67b82681436d8895773874043","sha256":"40dee8e22e3e97e34e2e5cd2168db23870158cc6bc0063d08addda505878ceb5","sha512":"6cbd484269126295fea2946bb5f110ca0f62de0bbdda8992557ac5fc5678ae179bc812d617e0302a06ba37aabeccd01886104ad300010d9841de1711781e84ef","ssdeep":"","tlshash":"2ff0f6282ea0f936805f2c57777ee24872a2151a9011e00468cfec1c6577fdf8eb5a94","size":574,"data":"","first_seen":"2025-10-17T01:15:15.112362Z","last_seen":"2025-12-22T07:27:15.784351Z","times_seen":497,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/ac-ui-shanshan.4fd61a57.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1da33a96e9761bbfb926c723229b5926","sha1":"746a0bcc7b5072738ce22a11b7033d7b9fa8da00","sha256":"f2ce6a063526275629adcc9b092d2a945ed92477b03093bf7cdeaa5da5a54826","sha512":"35b2ccaa82820ed5f9828de80fd67552315731c62b9b605b3ef9e0578c75caba4520d2c2418809a1c2c328783f011248fd6a77263d69b2dd2cd20b9f1bb175fa","ssdeep":"3072:vjh1RDXBzXrEd+y/cBDiWiiTn6AXvcyt8nmwsTbNi5bSSSSSa5Sbi:rh1RDXBzXr25Sbi","tlshash":"9d946f14b6e70d7254b7d0d99bae2d147a20c337900ace1e3a8c9bd58fc9c29a5f4739","size":436477,"data":"","first_seen":"2023-04-19T14:52:23Z","last_seen":"2026-05-31T04:40:23.164919Z","times_seen":2210,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/lotto/lott-common/lottTranslator.c6284a7d.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0366e65e37d971fddb185526e5cbd1d0","sha1":"0ab8abced80bedda7e35568ef258fd283156e4b2","sha256":"9d85cd8f38af3d44aea1c6eeda28cfadacd0dd2c1bf50f5662b4095412d29b1f","sha512":"f053f83b4b47dd43b69c4ad2d590a6c62c6ca960782713335c22e015a890de91eed8963601ee8789c8c6f30d28ddde46a2b15e85c2144cf4b268ac1f0e8db7b9","ssdeep":"12288:6uDcCDPGZbPZkSGV7dJ8TbGGZmIYmp2sP6JSzrpmfi40prt/2ZrH:FRPGZU7Y/Y5sP6JKrsiFB/krH","tlshash":"34453bbe93a62aec0d5db75b5e9b30a1153d0508acf427c2cdac1e1877ccd1da072a67","size":1214038,"data":"","first_seen":"2025-10-17T01:15:15.771145Z","last_seen":"2025-12-22T07:27:15.814475Z","times_seen":475,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/firebasejs/9.14.0/firebase-app.js","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.131","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"1133a24e73cc67fbf3a9002a2a8d2039","sha1":"08288a1be66c98dbd60f5d59b4e1b5ee23626085","sha256":"4fbb03aabc125045ee2d98be69199bcc01b9cb22aa2e438ab7422303622e0f09","sha512":"7b038fd80befe61ac54039577b161a7623cbef51f4485e6359c18d25c0d710686c2230def5ee72ea48d906292e2b76085a457c5813bdb6bd49c2d0c6d3bb6992","ssdeep":"1536:BCtUasrm5+7CClwUuDoYIt+/dpN/FZ6zeVjfPLXJpzKZyW:BCtvsrm5+7CClw5DoYIt+LN/FZ6z4jfg","tlshash":"4193a82d3bd5117206b253bc6f1ba486f72e822b2606a2d47cad83e40f7255942f5ff4","size":91683,"data":"","first_seen":"2023-03-09T04:10:18Z","last_seen":"2026-05-31T04:40:23.162707Z","times_seen":2309,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/aboutMerchant.js?v=13424","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"568403915c6cf2c3eecc0a299a35861e","sha1":"bdf3acedc4179c060a0ad0ec73032de39e7c4c0b","sha256":"a1e6867177e1d5a22d21ce39d9af84dfd9464457beb55b923f969f9c66057164","sha512":"4c8bf3dfab872448c88693036e62a98481f8ebc7add84670daab327c3e14142e0a4480d8e251943491346b47a9f88349cc7675c24eefcb85eaa0d858a0e45930","ssdeep":"","tlshash":"d941539eb14bebe205f620822ac56219647360d804b6e4817b569540b47ee4fc25f9cf","size":1984,"data":"","first_seen":"2024-12-22T03:03:41.35822Z","last_seen":"2026-05-31T04:40:23.160623Z","times_seen":454,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/chunk-web-view.5f94465d.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"baaaed2d9e14fd004408bac663afaaeb","sha1":"05760d6cd50b4421e521c89c26f18e6a4b57a6a8","sha256":"083887ae676afc4d9409ccb8789774c9e365dce9c9d828559dc4e615e3cb3a52","sha512":"856e10d63781b6206223690a0e3d326556ff8c5f724dab98b637a4cf51e2baa116ac60ed3b273931e473514e3b872d8b156c2ec9c1db5f869ca181e3e04c16ae","ssdeep":"12288:ZFus+31sVhkoUv7IIRRJTRS3x9efT8Fouztm41ouLO:uT1srkoUjRRJ9Eer8Fouztm41ouLO","tlshash":"1fe42c9eb1c3b1794bb36065202f3119b33b1d8464198844f635d8dabdacd5a932bfbc","size":663887,"data":"","first_seen":"2025-10-21T06:00:21.953039Z","last_seen":"2025-11-04T05:20:58.391081Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/index.aafb4390.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0e58581515fba701582d226ab6353c8b","sha1":"08eec360549d1d024a7e48af0c3eb423933aad1c","sha256":"917c2fc688414ec567771bf2d3a694a35c9cc0a119eed55965d1b18978f69e30","sha512":"b909541c681d6c0517fa2655033a5dc859cb9167fc17d483f8511529d2546dff72ff2d2db6b73c02e55e9d4877f29946b453ae13c11c176733506c138866b9ab","ssdeep":"12288:QagaWLaK/WHln6r9U1oGpnI0S53PHt5lP3f/mKY45b0eHS5aXQyMxTtIkMkRPehS:qmrVw4Ihl5Z3f/rT5b0yVKXIKtoLmL","tlshash":"5b957bf5a3e8a1e89607d3f0962ba460376f38fb7f91cdc493f889d4966148c845adc1","size":1918304,"data":"","first_seen":"2025-10-21T06:00:22.22214Z","last_seen":"2025-11-04T05:20:58.561254Z","times_seen":7,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/swiper@9.3.0/swiper-bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"4570fef97846ca636c3c49463f861552","sha1":"63c164ea279ab2a735d337b255a256bee79da0a9","sha256":"4651353cb061bc4c99cd04687a305193ecc7d4842aabf453914a59eab46781f2","sha512":"bf569392feb91f1548af4f4ccd5e9e30ad9c7580e34bd4a5231c5b91c2a7dc8a4d316d8cf31640e50e2e929f8f4ba74c1f34cb4b1962b35543ea87003f55319a","ssdeep":"1536:EIJAfGWjLP8NE6WG/KxXzbolxU/yBkt+TSD8wkvtnTClvwSmp8Y7CjGEG5/AsVuL:HJjNi+CyBkoBUvwNp8Y7Cji5/5cp5v","tlshash":"7ad309896221b57546e316db93e4c621a3b50540b80ac8f470bd4c9f597ec9813feffa","size":139695,"data":"","first_seen":"2023-05-08T16:47:31Z","last_seen":"2026-05-31T04:40:23.130246Z","times_seen":2309,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/mc-control-shanshan.67a67df3.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"67a67df37a683fb47d4b128e52ad6fc0","sha1":"8a8de648191f1550f63fc4cf5c02d5fa16f8a2de","sha256":"1ef532d0e40b66ad559c81c88d09d7bed392edaff1b772dc70518ddd88cfbf76","sha512":"302444b8fda2118104354c759546b7e19136e125f1e11d6607e8bd5402e09bfbc8f44b291134bcd29d9e71c4f1100ec98657a2dafd15a5584b84be7f95f197e4","ssdeep":"12288:Lq8ptRpT4EHWnt575j2gToVYOPCTaStX/AoZiN9AQMp1NONNMCA3gm0fEtfJ9BN/:uUXarntV5jk7ItfJ9BNMgSZ54mY","tlshash":"ca35184471e260e2217b7266609f66052676be32c40a4841f1ae99f16fbdd85f333f3b","size":1124763,"data":"","first_seen":"2025-10-31T11:25:46.486666Z","last_seen":"2025-11-04T05:20:58.561886Z","times_seen":24,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@thumbmarkjs/thumbmarkjs/dist/thumbmark.umd.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2d46b419f54c63207872b59ff9dad68c","sha1":"827edc1a2cb3850b7ed47d69d1c0ca07cb9c8e45","sha256":"7134e178f773638187c033f0a2247d1bf0c3fcee25918b1710331198c88ab49d","sha512":"009b4be496264deabfa25510dcc8f23a2d10170426c131132d470e5c12e398a0e1886fa4184c61ff0165bcf38e0d085786a959ed44725e9f18f97dbfb29fbfb0","ssdeep":"768:lqYkK5Hvuj2ZR62KtjqXn2bxqWGAGPCzA+Px0F3A/y95MNslps:hvMGMvgiEms8","tlshash":"2ac23ab5b2283027427b3ea7b07a810aa5356324355bc444f12d8946b6d7e8e53fbf6c","size":25965,"data":"","first_seen":"2025-11-02T10:02:01.647976Z","last_seen":"2025-11-19T03:51:09.886922Z","times_seen":227,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/decimal.min.b4a075bd.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"b4a075bd6623180bb38318dcf2542f58","sha1":"64207af61a67ff855fd152ca4dab1532973e5db2","sha256":"25dd4d16d5fd3c4ac796badcce3ec057d92c52255f8d8481570fb54549dac5f7","sha512":"f20bc2a23070cc656266fd0b654aa6270a0864a3c413fd4ece9bd3630423266829eafc39ef7f32728c97efdc5da834e89c840409e4adc0ed53004897f01341ba","ssdeep":"192:ZusyVYg81fsu05u9gpxe5afH5NVcvqfMNlkdOYiO5PjVYCrF1FVWJK5gDArHx:wsS4OogpxcGHjcwGO5PjVrrrFcJSAArR","tlshash":"1342c5d872b1f0d683f364e040db1406e13a6e49688e61e2f34985e23cb5ec6917ffa5","size":13043,"data":"","first_seen":"2023-03-07T12:04:54Z","last_seen":"2026-05-31T04:40:23.164421Z","times_seen":2227,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/mc-wps.95bc65b7.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"95bc65b725d2d5346826d21ab4a92246","sha1":"3e883f006d20fe20b208bed2126f765c45358bf6","sha256":"14f0c3f2db71bc07b1f912ad62fa02812baf2a74f687994e11408baa49eb6689","sha512":"ca3356d2efc759ea52c7343155257c7e4c8a85f08555bf4af9d17f46c74c30c72a81df44ec01deaa0c1a31c8d46a4897eb261f3ae7c54f70004347dea9b59756","ssdeep":"768:3Bx0qZAA+cPp2V7p1sX3iEJiSiOJipOfBi0Mu5XBe:3Bx0qZAA+cPp2Q3iEJiSiOJipOfBPu","tlshash":"4e5345c978c2a9ce7a33f53bcc5e7f152935be69842c4470415161aa2cf998c9223fed","size":61537,"data":"","first_seen":"2025-10-13T09:13:01.495309Z","last_seen":"2025-11-17T22:29:09.671811Z","times_seen":192,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/RegisterPage.03d7cb36.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"c06ecd82ac102f8abc7e4f9461364c34","sha1":"00e4863cd7ed4c6a5904bdd95efc8bbc4390a88f","sha256":"59b2f5a4c86cf7a3554e20b80cea4c9e3453c03ce2651ed4c5eb998c6237192c","sha512":"7b875e876ce8a578cd5f9206219a664070bd192c66ee19806519e557832f7165d01db628deaf1d470c85207c609dee80ed95f9f6d3a1ec13b5d7e2cb1a59ff39","ssdeep":"","tlshash":"b731331af0d2fc76df92706560bf0425916b2e881d1589a9f374e8c05aee0cdc423b7c","size":1582,"data":"","first_seen":"2025-10-21T06:00:22.05809Z","last_seen":"2026-02-09T06:38:35.128217Z","times_seen":29,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/index.js?_=1762233587036","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"089c104c7052a49db80451361c54d9a3","sha1":"fb51abc764ac93f47666e4063e48d01190595c24","sha256":"6520c0df388941f827d035c7feb34c23debdfa5eac20e11314cf351bca12b1b2","sha512":"736247d380b55a8ca15be3c53d430cac11baefe0bca6d497dbd9d4175a260b30d7926c82715aafb39ea312c4f725a77e29c586d7e282248413242955d0f9656c","ssdeep":"","tlshash":"ae11880e9bf380a8747b309f97ae6804729282875021d591359cd8e2ff64da402bdefc","size":875,"data":"","first_seen":"2025-11-04T05:20:58.43791Z","last_seen":"2025-11-17T22:29:09.817477Z","times_seen":58,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/ac-control-shanshan.7f819b61.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7f819b61b5d362132765bf9ce5c45ee6","sha1":"0334de6efa5c0a89b4243586c4e968731bc28b50","sha256":"eb44e88aa84aa4e15b8cafda3ed2d85f3bd5cac1e170399ca529bc21e4ede66d","sha512":"51967b579ce8f57e78f6d642872ced3da2914c3a718d72350d417d4a970269e39c1dffc25f4830e5c097f73b2e3f851ccae93a88c4ec356de9b087bf9538d10b","ssdeep":"6144:qtDthvN/EL4SfNQo0ysILiOMjJ1tA9wRh1cD/Xp8w12RAnLaqmci7F9Y3YbCqFAV:Rio0zA9wRh1o/Xp8w1DEKp","tlshash":"f3151a08b16715e222bb1172a49f670271666a7bd40a4c95f0bea9f11f7cc887373f36","size":907277,"data":"","first_seen":"2025-10-31T03:51:50.053031Z","last_seen":"2025-12-01T18:09:57.710205Z","times_seen":130,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/ac-properties.324301a7.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"0e464ce469f961b7562a4dea5b696a32","sha1":"fc847e4f41d3a763c575b963ba4b626d22381976","sha256":"928e43a437ac6d8b4d9aff77825e1d3208d78258c130ee41f67d3bc48e385b83","sha512":"45cf6b0aba76f0af061dc2c18e25a432d4de6dfb8bc46da878e0692eac73afb276e35266422896609f4b34b77bf539169b2d96a1d0aa3d7b1c699db633d57747","ssdeep":"12288:PTUtXN/1EvyZTc9LfVem0ZAjTwDyrQLlQfcQj4P1o+FY/ArhkRcZOGgQJgVhnb3W:PAltfUCLEZwDZOUH","tlshash":"5c751894ae2fe411c8ee6607b58d7a3150ad3d22d292d7d1ed6f0fde50c8c7c821672a","size":1677008,"data":"","first_seen":"2025-10-13T09:13:01.598253Z","last_seen":"2025-12-03T19:59:48.950846Z","times_seen":280,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/firebasejs/9.14.0/firebase-auth.js","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.131","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"importedModule","is_inline":false,"md5":"3e80f5800c11d19d455627966a2262f8","sha1":"c66be704649d09d8c567533662f30e8c071bd68f","sha256":"77eb87926cbc4ca21f9da2a1d9290abe1cc08683d401d0e08a7aabd6447b3982","sha512":"386fa224fdbc774a9541c9181b32293a1de7440c1f2516ea43f847c371b0edae019d5b24af80b9a2f0bc1c3e69274b21c30e35a4d346be0ae61caa3e476235e8","ssdeep":"1536:Tt0/Cwwg21Lrb9KhZs4+3WRO/uFnO89uYkXQIv3pW/HM2QFu7F7kE6+qXcw9p+3L:TtqwgMLHNgrFgEmkSCeoh","tlshash":"e5b3098573e7e03286e988ebf0770103e32d5958795d806cb22d9dda3d5b885b637e38","size":117350,"data":"","first_seen":"2023-03-12T16:30:31Z","last_seen":"2026-05-31T04:40:23.176411Z","times_seen":2202,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/chunk-vendors.851d9129.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"dfc4fc8d2282f13f37005746e9e677a4","sha1":"0bb7abe4a54ee0af50c5a053198d05f308da7813","sha256":"c08a9ed515028c619b13af2c2c128d124f1111ff605126e3456f22b7444605e6","sha512":"8afd745315dc914d822c013bccdc142dea10c7a76a91041b81a8cf5cbddcb10843f2a11b2c6b47b630e0c190112da06b6921e76dee7ce8cd9cc1647b9738a772","ssdeep":"12288:ZVcFigeWOg+YC48zg3Z9eBYyebfY+focSfs4I36WJJmhj5aoDq6ce5+b3OzXOJHR:X6e+amWV0xlRr3X5Ruszf1F","tlshash":"474517cd7292b0a207e361f5402f100bf33a5969680e8554f665e4e6bcbe94e427bf7c","size":1250244,"data":"","first_seen":"2025-10-21T06:00:22.218622Z","last_seen":"2025-11-04T05:20:58.563337Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/assets/entry/main.Bgvu34dG.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"60429d272acbc02f10f0c9b3572a9500","sha1":"6e2e8e4a9a4a655133fc98f56a46a43cb24ae946","sha256":"5abcd3fbe3ee6f63bcb43d47118812cf7f23e34c518f594d920ec047d56d7b2f","sha512":"1c5284aeebcafcc17bae74521c33beb138d05d955ae1b1344246602b7d03fa7d89c16d81e67bd9231307fdc96f7cb578145dd67dde0cb33548cccc4b944b4d42","ssdeep":"49152:d7Oc39Hw1t6yWC4Q4s8tLFbJZFgrK8eLY4SOyII5onpD/YOtXSf1QyAKURJw:vI","tlshash":"2685e6466af764308267f029475f9811723450072e48fe48b95d8ab81f9da3cb7f6bec","size":1766120,"data":"","first_seen":"2025-11-04T05:20:58.564219Z","last_seen":"2025-11-17T22:29:09.861854Z","times_seen":56,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/ac-wps.3b072057.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b072057f27560d0f025bd2ff4597697","sha1":"840f07915781d5d594a9b305ab44b047c01268d4","sha256":"2473cc0c67f26af070a2291c183b35d3504019f9067e5791b501367438aef5e8","sha512":"bfbfe48d61a55555b7a264070c2682cdf67429f3d48551ea6db2e699b8a19ebee8ac88c62e0973bd823049b6cf8a99507e5b941055ea73a206142676bf970c3e","ssdeep":"1536:USCAKqw8hylWOdSf+km+XR0w10Ok+KNWHR0cR0uRGvfouzX:Unz","tlshash":"0d3333c8f881ad8f7567753acc6f6b1d05377b4de0700eda818b656a1eb144da023be8","size":53168,"data":"","first_seen":"2025-10-29T02:20:53.469664Z","last_seen":"2025-12-01T18:09:57.843202Z","times_seen":138,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"Function","is_inline":false,"md5":"572cb94037fffc2a0a53b465972e15f1","sha1":"0d679b041a7c1ca45cc99e2d229fc2b86762838d","sha256":"6487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35","sha512":"f7c4db7986d362b58ff4b4646cdeb71992c0ce28949773c4471915f2cc8828329445777e228ef248f508f721a33dfea3d5694bc7ec18dc6c00134ee23155ff32","ssdeep":"","tlshash":"e3800455714110004f57115050171c444030007155407cc011c0d4710d51030110545c","size":34,"data":"","first_seen":"2023-04-11T21:16:40Z","last_seen":"2026-05-31T05:23:36.272962Z","times_seen":84646,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BP-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.619Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BP-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6370\r\ncf-ray: 9991a89e08df0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=7462\r\ncontent-disposition: inline; filename=\"BP-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb93b6-1d26\"\r\nexpires: Wed, 05 Nov 2025 16:30:03 GMT\r\nlast-modified: Fri, 24 Oct 2025 14:56:54 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6370,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"83563f9e678dc52138ae592d2a173b3c","sha1":"bfdf8012e63361d5462394950a2ff789a4a98809","sha256":"94d304ea4664efb00a2d07809f506d08fdfd28558bd2be3fbea17fbaab655f5b","sha512":"1878667ea7f56753aaca37781b2a77d0e49769c68f0c0858e7f3c2925314cd0587c23878b0d0bde4e4f73ad456eb92d289dc4e9aee3d2e5aff9c4e502c2263a0","ssdeep":"192:aZidQTZ9Gpb1EWUb0rypq8+utGb/ZUUi0JvrbLXY4:bQjKb1q0rGb4zvx","tlshash":"75d190a5c570d4d157e32d2facfe0499ae6773b3356aa53b846f28e0702e852312c5f8","first_seen":"2025-10-16T05:46:53.898091Z","last_seen":"2025-11-12T04:24:41.637299Z","times_seen":55,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/MAS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.678Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/MAS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11450\r\ncf-ray: 9991a89e491d0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=12612\r\ncontent-disposition: inline; filename=\"MAS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc229c-3144\"\r\nexpires: Wed, 05 Nov 2025 16:29:36 GMT\r\nlast-modified: Sat, 25 Oct 2025 01:06:36 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11450,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"927c6ded4608254d89d567e3839b462e","sha1":"5aeac027fc21fca58dba4cb1503efd711f719b8b","sha256":"55e8bb12f54b2a279e8e1fea061018feec784248e792e0666e3795626eae01a2","sha512":"ae9982ef6129afc98df61c0c075cec2059e2c18e26735b3c388530829932f2f750dd393f7e39a0e01afdcada60c73e471024bb0921a794f51ce78c6d20f103df","ssdeep":"192:+kKaH4S6i9PE3Q97VZhEu4R/jFqXxTeGAFyyek2VMotiW+x9g8nezXMPlWoWJpqD:qaYS6i9PGSThyjFWZeG3yqHtNieLM9f","tlshash":"d732bf7d65abbfc2dc1fa33c8460632ceabc718c7b962a07744533901b383d296219c9","first_seen":"2025-10-26T04:38:29.474347Z","last_seen":"2025-11-19T04:37:15.642643Z","times_seen":85,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.701Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11862\r\ncf-ray: 9991a89e69470731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=13621\r\ncontent-disposition: inline; filename=\"SS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fcb242-3535\"\r\nexpires: Wed, 05 Nov 2025 20:01:22 GMT\r\nlast-modified: Sat, 25 Oct 2025 11:19:30 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11862,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e7d0458a7fe3315dbf97152d9e6936fd","sha1":"20a344524e2025662d0530cd0898da95dd5ca56b","sha256":"a8c0a58434f3fc0554e48ca58eb47242e2574fb58cebd1529dd758f14ccbbf47","sha512":"0ffdc4eb2af4872c882aead9f00e5c189c30eb8821619425d83b0df83b40cb9ca4c6b9271f112a214cf73d2a330beefac493954dd2ce771b9618d4e9869a75a8","ssdeep":"192:htZIS3OAU9dH16GYoIZWcXUS+E6dK6Nl4W9I1ecwfE60/1q7H3Gc4naaZ71wIos:tISXUfH/lSv6IYbI8XBQq7H3G7h9eIos","tlshash":"3632d109f2d44b286d24c72c593f693a732d694a91a0c173f7dcafbd1a404b0db5ea80","first_seen":"2025-10-26T04:38:29.463101Z","last_seen":"2025-11-19T04:37:15.595136Z","times_seen":66,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/ac_shanshan.ebe1c9a3.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /ac/v.1.0.1/manifest/ac_shanshan.ebe1c9a3.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 30 Oct 2025 14:59:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69037d40-da10a\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AMokvP9kbAJ2oz8C%2B1%2FHC06CbvH%2F4eH1w9b0qV%2Fp1EERt3mr%2FAGvN0UDkGu2xJRx7gG5%2FrCqaplVl6%2BhIzZJUy2tv7scTc95p1Cj\"}]}\r\ncf-ray: 9991a8a0fca056a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":893194,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"41f544510af28453910cc846dad18cee","sha1":"dd9725645f398de463aa696d1facc030d143c1a2","sha256":"ac512dddb22cab23e383c9724f9eeece19bc8c428eae338fdb6da931e9ecc731","sha512":"54bf87c8b6e2d58227a775131e12a40e3af632fca4fd9c9db27bb6c6930c7578153877ed500dbfe08192b9c8ac86376ff05e8f2c34722effaca3187a356c7fb3","ssdeep":"12288:bxCOMik+aIdFqO5DfO2+oGiHBu667HQ0JhlaMkihwbT:H5ndbrO2yihu667HQwD4T","tlshash":"0f15e936eb47307db62ec11fbe48e1cf2f15c003d50b3e79b940a695c7ed4a42a62a56","first_seen":"2025-09-03T11:09:07.654762Z","last_seen":"2025-12-01T18:09:57.814922Z","times_seen":288,"resource_available":false,"data":null}},"time_used":567,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":567,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SA.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.203Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SA.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-335\"\r\nexpires: Thu, 30 Oct 2025 23:50:31 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a895be960731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":821,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6a6a776e6eafd7894a15b59489d256e0","sha1":"281cfb54b8d852da35ce28a1a1804448db7eacc3","sha256":"08682ff13de80ad64605fe065f59f341d7de2d3b927a9a46129765df631240e4","sha512":"9ba64332183df62999d5623097628fc187128988565c0ca6aa8e1c5ad7b60684365871514a7358ed41d90c99b86daddd7896f229aa87dcd2994c69e41dd4a678","ssdeep":"","tlshash":"b801cc2c8b2d976cec8241f85b79602416af269c3960005aeec8113220193cdf8ea5c9","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-22T19:21:41.083475Z","times_seen":119,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GH.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.341Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GH.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-18a\"\r\nexpires: Thu, 06 Nov 2025 07:26:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8968fba0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":394,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b732d1fe295ded76c447aa57902b9cc0","sha1":"a2171140c96d4c0dc44ede4726cef1b5105a05af","sha256":"f378a941b051eb665aacfac7a3ce2483dfb86318c6420f129402060ca0446ec7","sha512":"e5186afab5e62a006257dfb7702690b775eab29297da9d2b9c64e9aba9240edd8a8a471372891f39d140f7b58e28b17e1e47818d9e812f6b4b82f6d235a052bd","ssdeep":"","tlshash":"b3e061d1f4995d0d1d658be41f6db4d24166b1cd11d5069fb0400c1061557cb7c8bba8","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-23T22:43:38.301661Z","times_seen":77,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/CRG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.582Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/CRG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8840\r\ncf-ray: 9991a89de8b80731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=10336\r\ncontent-disposition: inline; filename=\"CRG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbcd72-2860\"\r\nexpires: Sat, 01 Nov 2025 06:20:34 GMT\r\nlast-modified: Fri, 24 Oct 2025 19:03:14 GMT\r\ncf-cache-status: HIT\r\nage: 381707\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8840,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ee2ba731fa59f7580cd977d0dd026ba8","sha1":"c5d4c1e4426d6b90307efb6d449d1805a8064f94","sha256":"c69a881b8071cf7a744f833633eca6fbc15e461e53ca1b8c4f86c32ea62d2918","sha512":"daf89ca85d0326a4e6ce9178c8f5e5b47a0d860dae9f13d7eee70ccbc6c3b0361a78b68de593b768d26fca20677864ff30ca0a7025132783763c3d73b5721705","ssdeep":"192:E1BWCvU0qAS1qa139XS1O+yTG9VidKuO8pApGKj0ppEIjc1BVE1F:OWCN21FSQ+1gKt8pAp5/116F","tlshash":"b202bf885260710f0d2a384962d93742ff47d3a79d793f6ada4078f8e7047a956813f6","first_seen":"2025-10-16T05:46:52.814849Z","last_seen":"2025-11-12T06:10:45.708082Z","times_seen":57,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BGA-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.633Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BGA-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4464\r\ncf-ray: 9991a89e18e70731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=5330\r\ncontent-disposition: inline; filename=\"BGA-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb75a6-14d2\"\r\nexpires: Wed, 05 Nov 2025 18:23:41 GMT\r\nlast-modified: Fri, 24 Oct 2025 12:48:38 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4464,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"29bc5d093da032c85bcb8d7a5970d943","sha1":"0f0889ded86f87b7a1525e5e126444653d579b13","sha256":"1a3255490538975aacf3ff34e67867e534015e9ad0bc95ed4516694abaaa539c","sha512":"43092850441a23a5124a92876f1fcb6b8f95c367f0590a5178a702d3c4b0a39a8d003426abc3a383a4cb30c7ad1060630a5bb189938513f48fc9300c86723cc2","ssdeep":"96:yHvzIIK5XJHBTsnbkPTWD13XvPnDxAdqCDgDNi8vDaMCSpSU5R:yPUIK5XJHObKu3X9kB0DBL8SpSMR","tlshash":"6f918d361beca13860257ff9020c3e71a8fac1ec56cc2f7329f5a519b64a12de314813","first_seen":"2025-10-26T04:38:29.602464Z","last_seen":"2025-11-12T04:24:41.612019Z","times_seen":56,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/VT-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.683Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/VT-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7706\r\ncf-ray: 9991a89e49240731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=8308\r\ncontent-disposition: inline; filename=\"VT-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fba401-2074\"\r\nexpires: Thu, 06 Nov 2025 06:29:21 GMT\r\nlast-modified: Fri, 24 Oct 2025 16:06:25 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7706,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"543e71ce9ee0ca274d6ba86a11654259","sha1":"b8d44d67b2e972c958196265c70b4bc0ca25598a","sha256":"a4d19be824737093dac069e62ef66a713b28d075b8a38acbb51bbf6bee2c4024","sha512":"4a0554bae92c8a31636fe3d38ad01380224d0780886ed11784043a0e072b327086de8abb39f8a969b51ea8c18f8ba2b0bd3725cfa163583d049d9d86173b7d03","ssdeep":"192:twcWjGZc5ME7LumYj+f6aKHATQQutc64N3Ez7sN:tncMwLumOYagP64REz7K","tlshash":"6ff1af1fadd9260263f3dc6d54828114ff0a8fa5ac9b7f68038a5014fe6da6973c9911","first_seen":"2025-10-18T11:41:57.62471Z","last_seen":"2025-11-12T04:24:41.578529Z","times_seen":46,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/system/settings/consolidated?_=1762233590089","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.103Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/system/settings/consolidated?_=1762233590089 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: x45jruq502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JBEUwUJCOrJRdgnvmU9wS7TSi2bHPWLox4mYow%2FywoLFEOUFm5ZbxKMRjxtroVzSBJMvkbK5hELV%2BG6meX0P1to3KN5lp9IW%2Fpvt\"}]}\r\ncf-ray: 9991a8a21d1356a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":36323,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"61fac8fadebaf9835f91987810919ebb","sha1":"aff91ec4f495c7cfc939fdd1ca10fab0348d4b32","sha256":"397023bb6e9698bebc607beb49b2d1e2d2450ab435db26768dbf641ad8d39832","sha512":"bb18f6048b7c00c21fe15c56fc7d26053f4793640b35e1a4fce979e3ecfbab5cf80a8c731d11a355b0b2511704c6215eaedb279606618fc78447740fe653f08b","ssdeep":"192:EOcthSIJWlAuAbPjPBZeM2pqioPXVY55GaOCwOUAR1JADnOD6dCCI46Uf+KQUcsl:EPhSIJWnAbrPBAj9I+lyCTsWOK5xIWKJ","tlshash":"aef2a009a420f9af1d4ec0c4e4fd991b59ad8e7ae5fd00718c0c29ac12eb9a50757bf7","first_seen":"2025-11-04T05:20:58.337769Z","last_seen":"2025-11-04T05:20:58.337769Z","times_seen":1,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com/dev-images/GCS_VENDOR_EVENT_IMAGE_ICON/3204.png?t=1762147337409","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.374Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET /dev-images/GCS_VENDOR_EVENT_IMAGE_ICON/3204.png?t=1762147337409 HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 4926\r\ncf-ray: 9991a8a3d8d20731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: status=format_not_supported\r\naccess-control-allow-origin: *\r\netag: \"69083c09-133e\"\r\nexpires: Mon, 10 Nov 2025 05:28:25 GMT\r\nlast-modified: Mon, 03 Nov 2025 05:22:17 GMT\r\ncf-cache-status: HIT\r\nage: 58940\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4926,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8d1fb147592522e57e01d2e3ca17e418","sha1":"0105173883747c11bc274f7936935cf2b9a53f4e","sha256":"3463d7c3ad064b8d6f07af1edbb0b9dfd25bee192961fd454a5c9466251e7c6f","sha512":"c9774974da5d2c85c3c1eb98ce8e01e9a52cf67f1e6e3c4e86585c5ac50a2019f76bc53cc8ebba58865030dd9a1e4bca657a5ab481ba11926c8af25fdabab384","ssdeep":"96:WzdyXI4hMWRvwpHSY2RQSPB62KDf2T/QaIDL5hZgW0Woet+D:Wz8442uopHSY2PP0TDIEL5hp0Woy+D","tlshash":"cca18f55647057a7c3e1a6de682df78d635102e2991def744113f0e8e12e0cfa0a4dcd","first_seen":"2025-11-03T13:54:10.870705Z","last_seen":"2025-11-30T14:48:07.384336Z","times_seen":204,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/firebasejs/9.14.0/firebase-auth.js","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.131","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:51.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Oct 2025 08:38:51 GMT","end":"Mon, 05 Jan 2026 08:38:50 GMT"},"fingerprint":{"sha1":"89:73:B0:EF:F1:BA:6A:DA:6C:2C:87:70:0D:17:11:82:30:E9:13:68","sha256":"96:8D:5D:62:3A:3A:D6:CD:06:9A:CE:52:F4:2D:91:F9:66:13:40:F4:5F:9B:88:3D:55:04:79:E3:14:96:51:FA"}}},"request":{"raw":"GET /firebasejs/9.14.0/firebase-auth.js HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.6789.show\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"firebase-js\"\r\nreport-to: {\"group\":\"firebase-js\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/firebase-js\"}]}\r\ncontent-length: 33722\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 30 Oct 2025 11:53:07 GMT\r\nexpires: Fri, 30 Oct 2026 11:53:07 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 10 Nov 2022 21:00:29 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nage: 408405\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":117350,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"3e80f5800c11d19d455627966a2262f8","sha1":"c66be704649d09d8c567533662f30e8c071bd68f","sha256":"77eb87926cbc4ca21f9da2a1d9290abe1cc08683d401d0e08a7aabd6447b3982","sha512":"386fa224fdbc774a9541c9181b32293a1de7440c1f2516ea43f847c371b0edae019d5b24af80b9a2f0bc1c3e69274b21c30e35a4d346be0ae61caa3e476235e8","ssdeep":"1536:Tt0/Cwwg21Lrb9KhZs4+3WRO/uFnO89uYkXQIv3pW/HM2QFu7F7kE6+qXcw9p+3L:TtqwgMLHNgrFgEmkSCeoh","tlshash":"e5b3098573e7e03286e988ebf0770103e32d5958795d806cb22d9dda3d5b885b637e38","first_seen":"2023-03-12T16:30:31Z","last_seen":"2026-05-31T04:40:23.176411Z","times_seen":2202,"resource_available":true,"data":null}},"time_used":322,"timings":{"blocked":141,"dns":4,"connect":27,"send":0,"wait":22,"receive":13,"ssl":110},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/system/country?","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.688Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/system/country? HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: 8c3nu5u502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=r5MEYCsZ1ODT2KquQSl388T6b5c8P7NKQSt%2BS6%2B0HJJK9kRi3L3G%2FOvab2vzwEuE9kuk7kJ%2F3YxNeYS06xiWhOdfcplYEw4fEbu5\"}]}\r\ncf-ray: 9991a8930d2656a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12198,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (11319), with no line terminators","md5":"4bc56979cf95b0d8d03264cc32596f08","sha1":"3a774c1f4171a8da2d2c3a4a9b535318b21e7a70","sha256":"17e5e1a4d497697a4c3d577bd1901cd510e783328b3769fd9f11e679b135e8e4","sha512":"7c31d60cd997520a14acfebcc1afaee221c51ead21b27394f422685ae4faa9d8bdd884b635d3c8a87ad3deea3bfe6cb1ae6bd91769e7bc40c776c123071e2d21","ssdeep":"96:l6jOZwkPVnUSDUx5hxFDJxk5ViPDFthda8fTL6lkD+kavc/o9Md2aWPaCKxm5OGV:lwYRgSHwxwwV51RmT","tlshash":"8b427b3e640ddfaefd36ffd9704f362554362944d2b8240acac057727b95afd21210a8","first_seen":"2025-10-16T21:47:57.532181Z","last_seen":"2025-12-10T22:44:05.953562Z","times_seen":64,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NG.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.189Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NG.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-12c\"\r\nexpires: Thu, 30 Oct 2025 07:22:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8959e8b0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":300,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9d60aa0d417e613d03cde8413545528d","sha1":"49e91c1ffb40214f7eb68ac670c8d4669c400c79","sha256":"ab75a08914c02ab04c98d5b000c028b177b3140b1746ba738bda294d6b4d6f59","sha512":"077d245f91f0ca43e9b1918e5390e492f709afa4729d2f4940c149b5b25df907c80bd6ae39f479444a7caf5fcadde2471ff8dfe2e481ddbf65a3aae053e76f9b","ssdeep":"","tlshash":"b1e0c2a1a0daaa5dab1482642f9fb1c54e23328922c50b6eb4842d20614e78a3946bd8","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.208043Z","times_seen":84,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/index.js?_=1762233587030","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /ac/v.1.0.1/index.js?_=1762233587030 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 30 Oct 2025 14:59:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69037d40-4b49\"\r\nexpires: Tue, 04 Nov 2025 13:19:49 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=hMzrJYOV136ilCN3jvWDDLN3RRcDSl7I7PQSfMn7kgTRoKg6g3GxZvm%2FaKWf5CynJoNRy7ViIr5xojPoDDxALukj3eZIXIEg9hkw\"}]}\r\ncf-ray: 9991a89aaa2156a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":19273,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (19272)","md5":"3d14b10e2174d6c0a210b099e387b294","sha1":"60705870a1aef58d3c7dff70f68e30ebff9781db","sha256":"885b995b499d93c76cd4d012c59ae4a26fb0c03099d9366cb002d2cb4ec34d91","sha512":"57e05a57c69c2e847f95ee187b1123351b9ce4ce8488a0602fbd987daca8e933ac4a7707dad78069d4090d03f32b21dee307f8f3abbd45647b9d9d579c1cb639","ssdeep":"384:cjOIzhu7En2roI1k/WaHjnFw73LeH+whSwoxzYMNwU30CkCPJi4axcNayjL+4ljr:FsBCg6l5CRn5a+AjwE69e","tlshash":"ca8243562d0f512d0689f5ab78804d6d7eff4ab21ac41d2db2ac8e7cc06d90fa9c93d1","first_seen":"2025-10-31T03:51:50.08729Z","last_seen":"2025-12-01T18:09:57.810398Z","times_seen":132,"resource_available":true,"data":null}},"time_used":591,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":591,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/EGT-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.541Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/EGT-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6954\r\ncf-ray: 9991a89dd8840731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=7591\r\ncontent-disposition: inline; filename=\"EGT-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb8767-1da7\"\r\nexpires: Sun, 02 Nov 2025 13:47:16 GMT\r\nlast-modified: Fri, 24 Oct 2025 14:04:23 GMT\r\ncf-cache-status: HIT\r\nage: 382087\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6954,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e57d87e6e4711d869ebc92e737343944","sha1":"08a137498cbabdfdec60af9e4035ecec391924e3","sha256":"7f68381271ab9cf81096ee4bd0fddd6809fe851c597fc5bfe8fd3ceb72c4d545","sha512":"8e622f12148e2d8d27923c4b73424b7943d7c6a87e9b923d19162a4442e07f3890c7e4427cbd596de52648802f5f23b82a89a43e8ee6b79c0ecea0636f5d1677","ssdeep":"192:ewndZbn0IJ8+dk8JAwjD1y7u+54++16W7oTAfu3i:Jdhtj07uepWMIOi","tlshash":"a0e1bf0a0eb63797f8283ba20d540ad145c3d01df7b68ea758b16e87d4f1c1132a161b","first_seen":"2025-10-17T01:57:49.09428Z","last_seen":"2025-11-12T02:57:36.934238Z","times_seen":47,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/RG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.660Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/RG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8610\r\ncf-ray: 9991a89e49190731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9172\r\ncontent-disposition: inline; filename=\"RG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbb078-23d4\"\r\nexpires: Sat, 01 Nov 2025 06:20:36 GMT\r\nlast-modified: Fri, 24 Oct 2025 16:59:36 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8610,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"07c7b95981d185395b09847de2472de7","sha1":"c3c612e4e968c095999e90d7a3d3b6569f663c13","sha256":"daa601c3fc784ae97ac203583726be140adf4f8a7640ad66070ad75c362900e0","sha512":"9357c7b3aecfbcddbd2ac94fc418b2ee32b7f834a5571f32dc32e4e737e9e4b1ac3d17631c54cabb36b14f70a24fe898f2bf4232fd432a5ee95ffbde0365a6fa","ssdeep":"192:yMxc82WFPx6QM2favnNHQy0KYNxoIX1eB4FM6gEywfF/5evH8QSS+IZPA4:yxWFPxmLnNNWoye6FDhywftIvHb+I64","tlshash":"6f02af4d84ec4d56730f1eba546ae5a6a80d4fe2f26ddb3c73a148620234c62390f37d","first_seen":"2025-10-16T05:46:53.908341Z","last_seen":"2026-02-20T11:53:39.579793Z","times_seen":82,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/UA.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/UA.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-119\"\r\nexpires: Thu, 06 Nov 2025 08:42:45 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a897088f0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":281,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6ef59119c38bc5e1eb860bd17fdfa84b","sha1":"0d5258329056b713e543ebfa9541cefc963540a5","sha256":"e6dc4d24003ec8f207d345280f8e3be96d749b88227afd61bae75a7b2be10205","sha512":"7277162cddcdd1df12926a87db5e4a289ec84e970f508057eee189cfaed4956899e7d2fe72824de4c279c6381e52c3e499326614db861ae7977728ff5e71f4fc","ssdeep":"","tlshash":"e7d02b62d2a9950da71443b4afaeb2d34473314c71c4034ef4402d05218ebcf7901b9d","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-27T05:04:05.930453Z","times_seen":160,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/WJ-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.329Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/WJ-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 28998\r\ncf-ray: 9991a89caef40731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=31841\r\ncontent-disposition: inline; filename=\"WJ-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fde954-7c61\"\r\nexpires: Wed, 05 Nov 2025 17:08:46 GMT\r\nlast-modified: Sun, 26 Oct 2025 09:26:44 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28998,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"abca88cf9a82f13c871603c190421c33","sha1":"7f66bfb0c9bdfcf22f3e11915e61de139d5c71e3","sha256":"1ae1e699b2480238cbb9b4bf284e6d2d1035a5302095bcd1ddc9a3d371254ab4","sha512":"94268b626dcc8393a742c5ab50fed1686e6f34e66115cdf2b5974995d8625e025131abd5ade9df39a7bb10e1645d31d73bfc1ef799bb8053a164840da8b88c45","ssdeep":"768:AAfPNUipIPObI/k4ki2YCEKaVmU+VgMTlHdY5DGbn:Ac1HImbInWYCEfQZ80n","tlshash":"7fd2e009b6bc33e1de8e694b653de1e2618362104449e7f084c0f45dcae6bc55baebc1","first_seen":"2025-10-16T05:46:53.165497Z","last_seen":"2025-11-20T10:07:43.581476Z","times_seen":86,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/LUC-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.385Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/LUC-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11074\r\ncf-ray: 9991a89cff470731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=12153\r\ncontent-disposition: inline; filename=\"LUC-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbe563-2f79\"\r\nexpires: Fri, 07 Nov 2025 18:26:43 GMT\r\nlast-modified: Fri, 24 Oct 2025 20:45:23 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11074,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"76dab0e4bb5fc9f86715f8306d7216e3","sha1":"416a41eaeaa4a60f8bdf53fbfe47704c37f48aaf","sha256":"05ee657bfd7ca430597f72bf343841c7c88c77ff142e0cebbb3a3f6275449f9d","sha512":"3f2e38131ddcda64e5db104fc6b713a8dcbfda0b5f513c64b72caa2829d1c4492e6b33c6d66091598d0c6db7105b64e6d9003592754c74a3ee087abb5606e259","ssdeep":"192:SAxtHf15LM3dRpqtQFA2z1HMxbLCAQq2p0eh2TPbb//jctztaAz4/Fgo:Px1KtRpFFAU1HM9CAja0eh27/bizdz4H","tlshash":"3232cf386e86b7b36d7f3c121118175007c56b61a093ebadecf05a78de582183b6074b","first_seen":"2025-10-14T07:32:51.220882Z","last_seen":"2025-11-19T04:37:15.514231Z","times_seen":49,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/IN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.078Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/IN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-1db\"\r\nexpires: Thu, 06 Nov 2025 07:26:33 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8952ddc0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":475,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"51112aca8b3e19c68fce3bc46f67f19d","sha1":"298835029a9e55e9be1a9c27d612db2c31c92158","sha256":"2ca4c5390345dec3c0c86d73c1f40e798027600ffbb5a96653f7799a7f71896c","sha512":"070f94a41d9b8d0e233ab22a88a582dc80627ed5c9f28fb04fc188b0b16c73b62e5c2f5d88a6062633e06d61a1a03004fe6b231a4cfb48c5b5638b3f71df2e9a","ssdeep":"","tlshash":"17f0a091f0aeab0cdf2496a81b5f71d2486372cc2387935eb4442d15251e3df39066e5","first_seen":"2023-09-19T06:13:15Z","last_seen":"2026-05-30T13:20:41.774241Z","times_seen":264,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/TP-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.530Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/TP-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 14880\r\ncf-ray: 9991a89dc85e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=17764\r\ncontent-disposition: inline; filename=\"TP-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd0af9-4564\"\r\nexpires: Thu, 06 Nov 2025 02:34:27 GMT\r\nlast-modified: Sat, 25 Oct 2025 17:38:01 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14880,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0e829d348f01aedb8497d872d44a73a8","sha1":"3dff326669429eca042d5de88a94e15a16220cfb","sha256":"b99e8e76d6aa33ac724457b13822068a25f5175284537f4091a65e520fc3c3c3","sha512":"697d3b886e4ea0334f9cf6a37b201a8f56d6063f7ecdb109b34d30ad71ad5fadfcb9796d304672403902ff5c496f9d62cdfd886da6225e6bb9302713a7d1a2ef","ssdeep":"384:TDKPT7xrLCYL5a2/JSDr9KKgkYk8kBv4k39kuf4gV9p4:TGL7xrLCe/JSDptgkL8gv4k39kuf/9p4","tlshash":"0262e19e597b014dac197cb8bec6aa338b8e004500dfa7659156ecb2251f70b81e746f","first_seen":"2025-10-18T11:41:57.038437Z","last_seen":"2026-03-01T07:06:36.983773Z","times_seen":82,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SW-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.693Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SW-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11540\r\ncf-ray: 9991a89e592e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=13968\r\ncontent-disposition: inline; filename=\"SW-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68ff4596-3690\"\r\nexpires: Wed, 05 Nov 2025 19:41:22 GMT\r\nlast-modified: Mon, 27 Oct 2025 10:12:38 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11540,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"37018ab7e38ea604f6ed5aa1607d95f8","sha1":"6ad0332da9c6662dbfb689b188fc2b62e8f9ed05","sha256":"1961c2cd49311f46b0e2ee1cf97697d822e72b7835599bd0457604f13763f6e0","sha512":"7c42270a41aab2c1d9fc57e820ea97e86cb9b9a2eae4b5dcac96fc03b53be7ef2db8cf9da6668b0a93b2d112490253e08c1dfbfb5f7319ab543e21c9bfd1202e","ssdeep":"192:f9ZgMU5l8+yfkqOaT5kCLCI7m712axZ7Gj1U9CNB6KvGrLs8UaT4wIcel7BRHv:VZfU5lPExLCim71DZa29CNBBGvs8hAlz","tlshash":"4f32cf003e66f4bd898855f35efa9019f3c4488e883eb9b60520547c3537b0e39dfa6a","first_seen":"2025-10-27T20:05:51.970161Z","last_seen":"2025-11-07T04:19:22.572887Z","times_seen":17,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/PROMOFE_getTicketGlobalConfig?device=WEB\u0026_=1762233590089","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/PROMOFE_getTicketGlobalConfig?device=WEB\u0026_=1762233590089 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-app-trace-id: f8xtn8d502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: REWCEN3\r\nx-elapsed-time: 2\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=rQbRMlmyPn0pDaFoBnrXq%2BmxYzIdELbe%2F4WwZsO%2F8w1qe4SvI8T0jH9A5mj70qUGJDJ2Lwhqsr%2BA4%2BVIhxi3RLOG3Oi%2BNjgxVYg6\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9991a8a22d1556a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":325,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"da84949534d76a885fb603c3868877e4","sha1":"8e0f4913c9ad480cc3277a4c53af5a5669496c74","sha256":"a6e011546286021a6ad4d111226842f30475fa95515682804832ef421a41f486","sha512":"441bb271f01bbc0e7b5a2763b11eb3bef91b6109a3a25eccd25b9b7a5356cd2778ec3218fa7743ca20bba671d13f58630f0954547e0a5511d0ede88fa83729aa","ssdeep":"","tlshash":"c8e07d3d30820c3384a356e5819318c3f41e837654444d4c4c9942063405b043cef54f","first_seen":"2025-09-07T09:32:23.285037Z","last_seen":"2026-05-31T02:25:52.889896Z","times_seen":682,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/qrious@4.0.2/+esm","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/qrious@4.0.2/+esm HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.6789.show\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 6640\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 4.0.2\r\nx-jsd-version-type: version\r\netag: W/\"459c-FGDl5OysMllgYz55EYyWgp8d+F0\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 1056590\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\nx-served-by: cache-fra-eddf8230052-FRA, cache-hel1410030-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17820,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (17476)","md5":"3f0602cee23a7b0377062a1a341d01b1","sha1":"1460e5e4ecac325960633e79118c96829f1df85d","sha256":"8478c77637d268ea9f88e1aae84dacd031256fb67063a8d94d222cd3eff8f84c","sha512":"7c1c6533f0e924a56239bb1395f6d4fd26cb9e718e355fc5448008da6fa6ca980d9a57e6d427e71e751cb66120dcfe5af1ce80d6b093d5336ab82ea63c0b9dec","ssdeep":"192:NMSJOPXg7hZv1fpYoE8GS9GLhgbHcj/13BBenIhG8+f3/pSq3c/WJBS7SEzonxKl:eSJOPX6wl8GfYUfhpfwcqEhwdlmRvki","tlshash":"a182859673a19269639669d5083f244f82f6e4193418429cfbb2c9dfbd3c4c96039f3a","first_seen":"2025-04-04T11:34:30.82088Z","last_seen":"2026-05-31T04:40:23.089257Z","times_seen":1923,"resource_available":true,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com/wsd-images-prod/6789vndkf5/fe_setting/favicon/wps_favicon_32x32_6789vndkf5_20250721174106.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:51.977Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET /wsd-images-prod/6789vndkf5/fe_setting/favicon/wps_favicon_32x32_6789vndkf5_20250721174106.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 964\r\ncf-ray: 9991a8adde020731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=1745\r\ncontent-disposition: inline; filename=\"wps_favicon_32x32_6789vndkf5_20250721174106.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"687e0b32-6d1\"\r\nexpires: Fri, 31 Oct 2025 04:26:57 GMT\r\nlast-modified: Mon, 21 Jul 2025 09:41:06 GMT\r\ncf-cache-status: HIT\r\nage: 434077\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":964,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e3ed004722e094f83e425f03430799b7","sha1":"0caa771302a5715f23787e0739ff8077c3b14449","sha256":"75f89dd9abf19c24a3a81c508e54808bfb3ec55100d8b8f2f0dbb11b1b10314c","sha512":"e61848afa89b649f8767de7153323cee2af150f1f6530a9d5921f998a240bfbfb44e92f1dacede7b3eede3c0e99852177639a359c3320571b39d566539eeedce","ssdeep":"","tlshash":"4511c8b206dcd49e82b71714cdd97ea407583b9788fcafc2cc5a3b98a71498b04e0717","first_seen":"2025-08-18T15:26:48.799293Z","last_seen":"2025-11-20T10:07:43.601611Z","times_seen":49,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/system/status?url=www.6789.show","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.048Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/system/status?url=www.6789.show HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: em0jd3v502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 2\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nErl6XjjAq2n9Vbe5b%2BwcyixN30Yja8EeDpyRAJKQelPpdA9G4%2FDPxmvr1vQEA%2FesBBnd6s7DKN5S2QiSiAB%2FZnQaj%2Bs2h1bprVg\"}]}\r\ncf-ray: 9991a88f0b2b56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36546,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ae278051565cf65ad596f754a7d3977a","sha1":"f2d40b58b23b67af988e4f02f7c1a6109a7ab010","sha256":"5b3f32b23991934a02e1c2620476062bde9c62ec793f0adda52287c01189bf8b","sha512":"2630b08f3b3bf803d9c2b621f72bbcc3f832cc662a6c173ebf31ea8a9663ca1db3f54fe29386211e876bc041f008718f1c06a9f47eca86f63628e7ee779c66e8","ssdeep":"192:SOcthSIJWlAuAbPjPBZeM2pqioPXVY55GaOCwOUAR1JADnOD6dCCI46Uf+KQUcsO:SPhSIJWnAbrPBAj9I+lyCTsWOK5xIWKK","tlshash":"42f2a009a420f9af1d4ec0c4e4fd991b59ad8e7ae5fd00718c0c29ac12eb9a50757bf7","first_seen":"2025-11-04T05:20:58.349008Z","last_seen":"2025-11-04T05:20:58.349008Z","times_seen":1,"resource_available":false,"data":null}},"time_used":390,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CO.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.133Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CO.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-154\"\r\nexpires: Thu, 06 Nov 2025 07:26:33 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8954e1c0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":340,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"27b71dc72631d9205fe646448225fed5","sha1":"d211b82ec62a10b79bcf92844e56bed7c17de08e","sha256":"d390a4acd9ed3a2568311c5e45eb58c5a48bbd7bca7849106cf316d1c7d9fee3","sha512":"161b7ea17d8c457000994b2e895e6fc2c8d1abdccdfbcf6d89e3de20ec6c658d5626b5d70ea17efb87f95fdf3154fe4d2a16d39060a9e95f4ab8e1197b3c4855","ssdeep":"","tlshash":"e7e02691e5f9b61c5f1442e82f6ef1f245a3314db1c5035df4001928224ebcfbd05b98","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-28T05:12:57.226339Z","times_seen":138,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AO.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AO.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:50 GMT\r\netag: W/\"643cf38e-2d3\"\r\nexpires: Thu, 06 Nov 2025 07:26:33 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a895feea0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":723,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5b8624837922c3b279072b0b1cf3c43d","sha1":"7b641dedb20ab58a23bb5ae937876e7b8618b9c6","sha256":"d3ef4aeb01e629fff42e6e9fde773668de1359eb3446e4d81788ca0281a020ca","sha512":"64e8b28a69127a900dc4598dfb3a535355aa8f4e8c39a6cb6fad15088bb69e6e9d1a455286ebf374dfdc302e732dc27231488970ff80662b9e07944dacd28057","ssdeep":"","tlshash":"ea01d038e668265d182643f05f6c70b8072e339c30ab0349ee5d1620305a3cae9a7e98","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.170269Z","times_seen":74,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/VE.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.477Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/VE.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-410\"\r\nexpires: Tue, 04 Nov 2025 02:53:14 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a89708920731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1040,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6f3250ea4752641871f933f0c98cfba1","sha1":"a099b9829ede807267c1b0576728975f8b9d811c","sha256":"47bd6cdcc25c2d141378fd47f78636f5855130b718a7493083ffa50c7e30fe6a","sha512":"799c00d4f3f57bc6b3be85e9e86b49da56f629a83438b2763695ce2857b5ad55f07008de4d55dbc82f67b1f85ffae21dbd054c346c0e0f399813bfc77ca15ff4","ssdeep":"","tlshash":"7111c991c2e0f5b89ec09394893db5f466fba13ea0d6021c50a885e0bb48ac6d7cdfc4","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:55.930265Z","times_seen":66,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/GCSGAME_hotGamesV2?merchantCode=6789vndkf5\u0026isPlatform=2\u0026vassalage=\u0026platform=flash%2Chtml5-desktop\u0026language=VI\u0026ext=avif","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.820Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/GCSGAME_hotGamesV2?merchantCode=6789vndkf5\u0026isPlatform=2\u0026vassalage=\u0026platform=flash%2Chtml5-desktop\u0026language=VI\u0026ext=avif HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nLanguage: VI\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: mruhyiw502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: GAMELOHOT3, FREEPLAY3\r\nx-elapsed-time: 2\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mnywUzFBIDCZdPi%2FF%2Bxf39BpWUWfmRS8GjcigSopnQRTguRiiwA%2F8IYZ%2B6JNjQF%2BgyKmE8SKib7ZRHFDc0svZ18sryV7ZMT%2F9RpT\"}]}\r\ncf-ray: 9991a89a19ae56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14988,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"a392cab74a9b362f387180bdb872c87a","sha1":"8002c0dd567a0abc8ea351f954b3374e01ab8ac6","sha256":"9ff1aa74479a3d54f9bb95a8acaf0365b68b4bf0b0bc8c068efc627449d9008a","sha512":"908973d27b71111820e12eaf813683962daf691142509c7972b39cbd7903751f3ab2ba75cbbc63768b073d9e9909471761246aeacca48d9f77978f9fba13d3c6","ssdeep":"384:kltzX888H27WQzbGlRbxi8zZPlb3eleOCjlOv240:kHIzW6QOb5sKou","tlshash":"0962ee88a2186cca17794ef8248ffeeae4bc049f45c5cf7461a49f194afd73c6206259","first_seen":"2025-11-02T09:33:15.737998Z","last_seen":"2025-11-04T05:20:58.351942Z","times_seen":7,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/3S2-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.408Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/3S2-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 20068\r\ncf-ray: 9991a89d0f720731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=22887\r\ncontent-disposition: inline; filename=\"3S2-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68ff3fb8-5967\"\r\nexpires: Thu, 06 Nov 2025 12:01:46 GMT\r\nlast-modified: Mon, 27 Oct 2025 09:47:36 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20068,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e0877bae30e18d7a5930cb128025985e","sha1":"37757446fd49fbb0b92cba6dabaae36870f4c145","sha256":"cad340b8da19a3455fc407d95690178e8ec15a5e1a732ffefb095e753d4fcac1","sha512":"8d72e22b29bf1ab0930020731699e1a7c620b4ae2eecac28421dccc388f6041bebf87e047239c132c0b56faf1db0f86aae7b19474303c1d5dc93e60bc43ad512","ssdeep":"384:yx0D+eVbjiDUbNJqXcqnzwHLrEQR89t2qJ3k1VdJiTzq9D4mrL3:yxHCbj5bNgckCLnmVUxJiT2Z4mrL3","tlshash":"da92e1aa38a8758ea2f97313f27c439473b7d7dc23c3af912141f4c58daca1491a2681","first_seen":"2025-10-27T20:05:52.087076Z","last_seen":"2025-11-20T10:07:43.6276Z","times_seen":45,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/html2canvas/1.4.1/html2canvas.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.924Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 17 Sep 2025 19:09:23 GMT","end":"Tue, 16 Dec 2025 20:08:48 GMT"},"fingerprint":{"sha1":"E5:FA:6E:21:DA:AB:92:8F:E0:CB:31:C2:87:D4:E2:CE:9F:23:BF:C1","sha256":"E8:C7:D4:A8:29:E6:45:C0:C5:E3:AD:6A:90:36:30:4A:D7:2E:7C:F7:8F:57:44:E8:3B:2D:AF:F6:80:F7:4B:46"}}},"request":{"raw":"GET /ajax/libs/html2canvas/1.4.1/html2canvas.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 37629\r\ncf-ray: 9991a8a0eb5576ef-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"61ec4640-92fd\"\r\nlast-modified: Sat, 22 Jan 2022 18:00:32 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 521944\r\nexpires: Sun, 25 Oct 2026 05:19:49 GMT\r\naccept-ranges: bytes\r\npriority: u=3,i=?0\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=hzdKCuCDTtCj5ygY2l7JTwEByrZD8tmHaGrNsK96ZuKMj%2FJs%2FFto62I%2FegBzED19Hs1R2iJtcmWtOS%2Fn%2F9C0d8TBFE0vgJA3h4QEkrgzRfX2qC0YMxfPgZ32hbj%2FZTLZ0Gj0xQkJ\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":198689,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64372)","md5":"d7530aa0b7587e627484c49fdf8f13f2","sha1":"b987dc0cc6cfcdc2e34499375f505470c5adb891","sha256":"e87e550794322e574a1fda0c1549a3c70dae5a93d9113417a429016838eab8cb","sha512":"04d6914276096223d2a871c36f9f01d3268f7c2bbe5a076cf06a7f814df792a06d80d4b8b523c7b8689bca87aa315fd326548a75ae855f3a04c981a34defaf5c","ssdeep":"1536:dLkw5M8eKEsqi5xpg+n1sPMecC9JmgxBQSFkkZQRlNM7IgeXzh:dLUtZSpg+aZmabZQz9","tlshash":"121457b46ba71cde0a7ef49b00172d838d981b67117fd1e8f24aada62d70702ceb1574","first_seen":"2023-03-08T20:20:59Z","last_seen":"2026-05-31T04:40:23.225817Z","times_seen":5966,"resource_available":true,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GB.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GB.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-331\"\r\nexpires: Thu, 06 Nov 2025 07:18:54 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8952de90731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":817,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c2c3cadcc5b107aaaee8df05b7811921","sha1":"a14a45989222a601d7968ce21d57339b09a9a9a1","sha256":"88169c656c516ac6374fe2a7988e103f6eb99db165ce6478aa68ce1b74e67ba9","sha512":"f8483151821d6c10769af6bd5bd8ab1671bf96ef99eb63747ad7c932ca8d86d6a1f89b330e01f56be1afd832ce4676926578e1a3c5c26292071b380564e6c3c2","ssdeep":"","tlshash":"31011221b5ece48e5b1d0e1fee2df0c82d51a78897c743acb1742521314f08c5b89b58","first_seen":"2023-05-25T21:07:42Z","last_seen":"2026-05-31T05:33:23.979094Z","times_seen":854,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MX.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.247Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MX.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-638\"\r\nexpires: Thu, 06 Nov 2025 02:38:09 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8960efb0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1592,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3ec0ef90ee44d55257594e5b320af639","sha1":"7a677d978e6d9a4c0805a3d56e8314a517f89f1a","sha256":"2348643e40a35e21443e9913eec800683a12acdad9aa96ba07d786fe1747e192","sha512":"7f5828f597fbb4bdbe975d02acd93fe62af1fabead0519a4b1cef0c83c2ab8ac40a6faf7e0757386ebb7ce95b838b37385074e892e984d848f4b37ee84541b08","ssdeep":"","tlshash":"dd31f1a1f6bdf05d8a0252980f1fb4e7416673dd533a024d70ac64b0358dbefb607614","first_seen":"2023-09-19T06:13:15Z","last_seen":"2026-05-30T13:20:41.812726Z","times_seen":261,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/MCSFE_getListAnnouncements?types=B%2CPL%2CPU%2CPR%2CH\u0026platform=W\u0026ext=avif","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/MCSFE_getListAnnouncements?types=B%2CPL%2CPU%2CPR%2CH\u0026platform=W\u0026ext=avif HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: a9gwtk6502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: FREEPLAY3, COMM3\r\nx-elapsed-time: 24\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B6xWjes5h8vTgiKe4RpdxIOdPhjCQE4bBIcO%2FPUNmNzee7R1LnFNXyEJaAiAEWdmK8bbIo%2FM7FO9icbbFDDPD25ErpRTnWHzDliu\"}]}\r\ncf-ray: 9991a898688f56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":610837,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"509c2576cdb4698334bb1e4d950fc980","sha1":"2cfb7a341f951323250150c17d752718717fd55d","sha256":"04ea1c508040fdad73e37f93f9e4144432d297cb23b15c922171762d4aba511a","sha512":"257a03a88df3889a146d30b02c5f1fa7fbca79d5b88800d6f7b04710b9c20e71bcc76d4be1c03d67bad363b1d27674dab1df8f0992c74c697b61012da696ec7f","ssdeep":"3072:isvBrTsvBrsWH7q4V3xc5pQq4V3xc5pqNMN2nCyAnCyxhgh2i6xEG/Suoi6xEG/U:Vhfhghbl2lyEOJLp8","tlshash":"51d4a52f56069135b1295fceb3c57ba3219eb509f563ab38be9fb94a43c4430d424b8c","first_seen":"2025-11-03T02:41:39.712671Z","last_seen":"2025-11-12T09:10:09.355621Z","times_seen":4,"resource_available":false,"data":null}},"time_used":238,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":238,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/IA-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.476Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/IA-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7590\r\ncf-ray: 9991a89d6fe50731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9069\r\ncontent-disposition: inline; filename=\"IA-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbb142-236d\"\r\nexpires: Wed, 05 Nov 2025 19:19:42 GMT\r\nlast-modified: Fri, 24 Oct 2025 17:02:58 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7590,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"db1f92a91689dc25d4ef1b01593d8382","sha1":"d3ec66dab3d2694ec31a549d2132adc4c32d2ee8","sha256":"487ede8cd7dced364054e1b872ac8947c4ac2768dc6d6ac492a820dabb80a35e","sha512":"e1887cfe95c6a44d853a3823c5f7d3aa28d7877f803fab1703cd09b7cf05d822b85bad022ef9c3232b76e1afc273abdb87ebeb38b8ad8c19295f605b43c4f5ae","ssdeep":"192:uAsuGiBfj7jTamkjJlzzwjyKJHF8XcxC+ACVG4WFE08e:uAz5B7HTZkjJ+WKJHksC+ACsAe","tlshash":"23f1ae3ac70136831417802d10faec28e53d8afceff5ca97849ee4c37a44da02b565b8","first_seen":"2025-10-16T05:46:53.170999Z","last_seen":"2025-11-12T02:57:36.882466Z","times_seen":49,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/IMES-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/IMES-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8440\r\ncf-ray: 9991a89d6fe70731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9459\r\ncontent-disposition: inline; filename=\"IMES-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbbbb9-24f3\"\r\nexpires: Sun, 02 Nov 2025 13:47:16 GMT\r\nlast-modified: Fri, 24 Oct 2025 17:47:37 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8440,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c0a0326d8362780af543aaa3eb49435b","sha1":"7e671974a644fcbb1b0156a9c47144fa13ab411e","sha256":"dfac4022c22653b20d084d21f6e6a82f4d7471daac3431872894318b5af93635","sha512":"ad3e01d315630cd17b279eaaf8c2f1b44a816b7bba3ec7da8511d20fe87442bf82d7cae0b0b0acec4a40b1223c9c8f3d3712c39a805f35523fcdd55d5daaf36c","ssdeep":"192:zHd3j4WprmiBJmSnFP7/f4UGaxz2yWxkePP8tKPZF:zHdzxprXJFs+ckkRZF","tlshash":"1f02b05b0d8873fae4e66fa715d2303504fd8091a8a36905e8bbc7e8d0c2bd16c5ad0e","first_seen":"2025-10-17T01:57:50.304174Z","last_seen":"2025-11-12T02:57:36.847699Z","times_seen":36,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/NE-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.659Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/NE-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11522\r\ncf-ray: 9991a89e39150731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=12852\r\ncontent-disposition: inline; filename=\"NE-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc3904-3234\"\r\nexpires: Wed, 05 Nov 2025 09:53:34 GMT\r\nlast-modified: Sat, 25 Oct 2025 02:42:12 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11522,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"544ac8140f272dbea90c37307835ab64","sha1":"fb32a7f0ff2df90eec21deba2f4f09273f3737e8","sha256":"cf6fe2507b50772e2d7b3578680d1c777f39bcd2432c613fefe85fb1929f3979","sha512":"c13a22fb40a69cc78e8c61459812b1dcb8ae1925fd16a4772e66019d81dc4843ec4f71082351c9496d26711d8743ae66710ecd217f30c37a127c54775043a483","ssdeep":"192:HUGCrxKwrf51Y9TD8UjlypdrBhboSsmz4t/eLrsTun2eoFX95OYLbYv4aje:HUXn5+vHlydrBbz4t/ecTuniNrCve","tlshash":"b032b0cb1bcb755a7ded35a11e98ceaa6d2fe351f1022b48ce801a8e767298c06509d4","first_seen":"2025-10-17T01:15:15.54705Z","last_seen":"2025-11-19T04:37:15.657758Z","times_seen":84,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789c1.net/","fqdn":"www.6789c1.net","domain":"6789c1.net","tld":"net"},"ip":{"addr":"104.21.16.134","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-04T05:19:43.112Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789c1.net","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 26 Oct 2025 07:56:35 GMT","end":"Sat, 24 Jan 2026 08:55:15 GMT"},"fingerprint":{"sha1":"52:25:B0:FC:F3:63:C6:D5:4B:3F:56:82:ED:04:9E:6E:94:D7:03:32","sha256":"23:DE:E2:76:CE:E3:84:D5:FC:2D:56:61:43:CA:1F:99:FF:72:F0:E7:41:05:BC:F1:05:4F:15:5A:AE:E5:81:5D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.6789c1.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\ndate: Tue, 04 Nov 2025 05:19:43 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://xukqq.6789.show/register.html\r\nserver: cloudflare\r\nstrict-transport-security: max-age=0; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-xss-protection: 1; mode=block\r\nx-content-type-options: nosniff\r\ncf-cache-status: DYNAMIC\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=05wJVzORWqtq7gL%2BTEQzxQ6jQVw3Z5BvU0%2BmIgRWpt3IOKbYNIY3heFOp%2FHg88kSNFJDkae8T%2FW9%2Fu%2FvuKy4jQbJeGQyRPNpcpH6uA%3D%3D\"}]}\r\ncf-ray: 9991a876c84fb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2043,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-05-31T05:23:22.948737Z","times_seen":15945479,"resource_available":true,"data":null}},"time_used":914,"timings":{"blocked":56,"dns":37,"connect":1,"send":0,"wait":802,"receive":0,"ssl":16},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-11-04","alert":"Sinkholed","trigger":"www.6789c1.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/WPSCORE_getDownloadSetting?domain=6789.show","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.699Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/WPSCORE_getDownloadSetting?domain=6789.show HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: hdh355z502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 3\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=XQ7UxvRRAgG7UktpbDJDRzG3w0SdGegbWLfnwyV3HGPq2VGMwEOdUsAoPuslB81Sw0Tgu%2BuPMjQBfMCkoeCatOzcfzEdQ8YlB%2FVh\"}]}\r\ncf-ray: 9991a8931d3056a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1736,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"aa712e4901673101b6dd75af4af49a3b","sha1":"d2836f11b98a48ed0aab1e04381aac8c0fef3a64","sha256":"5c29fa8849eb602313bdf4dcec791ab65650a2ba3ef2100f7a7cca7d410d061a","sha512":"733efe9d6cedaa7834d1cd98cb35e38a65c74ae621a044fbb1c3bde5fc22dfa7f49f19b9b7a463cc3989cbd9735e66e7fb9b59a60cbb0d11f495a8ebe8ce34d2","ssdeep":"","tlshash":"6131a06a281568f74cc6d548e3bc7b13201ccd7b209669769435d6b97dfbd38030387a","first_seen":"2025-10-30T04:46:21.391698Z","last_seen":"2026-02-09T06:38:35.229287Z","times_seen":36,"resource_available":false,"data":null}},"time_used":400,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":400,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TH.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TH.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-185\"\r\nexpires: Mon, 03 Nov 2025 02:50:38 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 322360\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a894ad340731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":389,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f213dbbef7b45a13ca72862af6e662d3","sha1":"2136b8d22c0e1bd4dd6ec8171edb0228fa2d3d42","sha256":"ef842ff877873b4438f24d06d618c0e567832eb538c2b6d2f83c5052e94db237","sha512":"3c58451fb2e55a0f36e7e8461741b83cbda8b4f111e2d18441b4190fcdaf0e302ce13aab6a868ea51dd12b8f9c8e920abefabeecbce9ac29328357785f64763f","ssdeep":"","tlshash":"cde061a6d0e9b68cae040154af4df1c10557218951c503deb4010931910ebcff889a58","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-30T13:20:41.815109Z","times_seen":318,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AR.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.344Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AR.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:50 GMT\r\netag: W/\"643cf38e-20b\"\r\nexpires: Fri, 07 Nov 2025 01:27:03 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8968fbc0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":523,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"50bcaaec8c29006da8cabe0b097d9847","sha1":"be206bca36d81aa7324df88859d25a1f4e875139","sha256":"e5b242113ec0eb86a7df29fd9eba2e5a66d254d6c60ab25b8c58b105d27a4e20","sha512":"1eec868834b34ccdd11fbf203a6af1c524aadc034a76796e6dfcba0451e2f2dc2947ff1b49c0e4ec656b7f1b78b0f36838b34fcc697fbf11ae9f9a68fb40bc36","ssdeep":"","tlshash":"aef059519578515cae0083a48ebdb5eb48fb244f62c4434ead047a90704d7cf284aede","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-28T05:12:57.244179Z","times_seen":152,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BT-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.648Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BT-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 25988\r\ncf-ray: 9991a89e28fd0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=28086\r\ncontent-disposition: inline; filename=\"BT-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fdce31-6db6\"\r\nexpires: Wed, 05 Nov 2025 18:52:28 GMT\r\nlast-modified: Sun, 26 Oct 2025 07:30:57 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25988,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"517b9d0c23d5a8230537e0cdc2d0f712","sha1":"affb82a2d1a3f4dd4fffcc33e00e3786d17078b7","sha256":"ac750d64dc7a7e4629295a4bfef7fea8d267778f07efafc77b996302c8367393","sha512":"f142019c2b53486795d52ce773a72c70abcb27137fee50a28257e53efba8618f07d10d111f7de970f476877ee8bc20c6b7bf2973a936caeb3a0190715dbf20ce","ssdeep":"384:n0BNFgiNATSCNOvCDPFESZ1H7NQU7s3QhEU7nQIBxTQ7fjEUWWX4AqGQ65l1dKRc:n4f98SROFES72e/KAn3Gjv/kK5kXJCb","tlshash":"61c2e1f79576ffddbc624cd52514b982b1941e8188444f3a3602d3d3c92ee169f2e03a","first_seen":"2025-10-17T01:57:49.769346Z","last_seen":"2025-11-19T04:37:15.6736Z","times_seen":80,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SWG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.734Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SWG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 22730\r\ncf-ray: 9991a89e79720731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=26056\r\ncontent-disposition: inline; filename=\"SWG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd5bfa-65c8\"\r\nexpires: Tue, 04 Nov 2025 20:40:31 GMT\r\nlast-modified: Sat, 25 Oct 2025 23:23:38 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22730,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9a29b3b6e2df4821954acaa5d89d15a2","sha1":"25f5f41dcf3d37ae8360693f43532491f74f6b6f","sha256":"b1a782d08b455fc65582f0d16441f668bda7dc3e14833e732242e5e2587d4fc6","sha512":"0a283bbddae9822b4f264a7446536e5211f7b5997b34b58512834d40dc1614d2e274f70117007c0ad04c98c48599b059ade610f28f6456858aa47eeac36b9131","ssdeep":"384:5BLTMqtZNyxebotpTiZnWZdz9dnSaGe7diPCxgBO2mH0/pz7k8duQzXXABrjHICO:5iiZNrU3xDxdnPmrO2PtIZkXwJLzGKzQ","tlshash":"62a2d13fc7d9f6050988c2eb215f483c946ef72f27066782d097e850b4619a6d46e4bf","first_seen":"2025-07-21T19:47:03.258586Z","last_seen":"2025-11-19T04:37:15.628332Z","times_seen":159,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/v.1.0.1/lib.js?mc_t=shanshan\u0026ac_t=shanshan\u0026version=v.1.0.1\u0026ac_v=1.0.1\u0026mc_v=1.0.1","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.034Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/v.1.0.1/lib.js?mc_t=shanshan\u0026ac_t=shanshan\u0026version=v.1.0.1\u0026ac_v=1.0.1\u0026mc_v=1.0.1 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Wed, 29 Oct 2025 03:03:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"690183ed-1956\"\r\nexpires: Wed, 05 Nov 2025 05:19:47 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=pXFY3yJQDHLGNbHahViAADJibKrxWxxuUPOUTjymdeU8vy7gnDbyzVdgf5jG73kiW3SmEa%2FPNTqt4ItnZsDG8XoLpepIDPdjV37o\"}]}\r\ncf-ray: 9991a88efb1e56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6486,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6484), with no line terminators","md5":"3aad2612dfcd43b8dfed1ca072aa5c21","sha1":"d3d97c5ae4454416d627ad3e9c5ed7856085b981","sha256":"8da0cbe25140dff92f08b7d1ecebd3da8c2f47c9d414dba6cc5bdcb4f7006de3","sha512":"206f426ea79f4ae420686a5a40e2ecf9ccabf1b6970a125ddc66ccb65e584c089622163fdc4ef94054734cd0869a2d1090fb66980418de0b23887aa0805d229f","ssdeep":"96:fYr5C14peqd/VyZ2N+dE+sf14D55gBmBEZQRZlgPhanvxiKLKH6aDVAG0:S5C1G/Vy8Id5n7gBmMQ/nJiGWVAp","tlshash":"1dd1504d7525f494a2c7a1a4c27f5c0fad37246e2829c034f5c1e9e2ad78e4d812bf5a","first_seen":"2025-06-14T14:10:40.274801Z","last_seen":"2026-05-31T04:40:23.135947Z","times_seen":1901,"resource_available":true,"data":null}},"time_used":562,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":562,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CM.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.383Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CM.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-1c1\"\r\nexpires: Wed, 05 Nov 2025 04:56:38 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896b8000731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":449,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5ef78df88525c24662ba4535bae29058","sha1":"da900e71224060165bff823b29765ffe4bd90920","sha256":"99f3e751599a0429277112445ee00f31a3dbf3b0b07635a30ec2c0d884fe2a40","sha512":"5d0b07f78249e576423cdf780ce36351a50d2a5d6bee62c1a7e5904930b20b518a71ec823efba94274527072e941d070c702859d3e3d568b8deff6a7684f5803","ssdeep":"","tlshash":"68f05ca9f0bd754c690906782f9df5fb005632cd56d8058db4801450b16d78f7887aad","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.186022Z","times_seen":84,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/agent/affiliate?domain=6789\u0026code=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/agent/affiliate?domain=6789\u0026code=xukqq HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-app-trace-id: m8yh6n9502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: AFFMAN3, AFFCODE3\r\nx-elapsed-time: 3\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=UIcyFlCRVnyW%2BfhGNpYHuyaQvN65fCfKfKnVmLjdFe0fGbxlk8cZ%2BNnFYP%2B4sBwpwLh1qslSxkZL3L25hjntaOXXm9ps9agzXO2R\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9991a89bbaa256a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":96,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"71ba73ad174cc3e75cfddabd19b04469","sha1":"8eff974ac885824e9a0b88de817f772928841f0e","sha256":"4f14ea4f69084b5a63fecb2a41274f2fc7c6b3187065446cd4b544aa06cd2761","sha512":"44de82716061f29d9bd46681d4c488f341ce8989d7007dcba12a6e7365875db60ca5a3b279f5ee2f7f22472138558c7f4f41e7a32c50d7e4565fc475bf062484","ssdeep":"","tlshash":"82b0120315b04412cd433300186d1b177d7c0095cc1805a49bccc03cda4c440a953746","first_seen":"2025-11-04T05:20:58.362255Z","last_seen":"2025-11-04T05:20:58.362255Z","times_seen":1,"resource_available":false,"data":null}},"time_used":196,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/OCT-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.574Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/OCT-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8400\r\ncf-ray: 9991a89de8b10731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9731\r\ncontent-disposition: inline; filename=\"OCT-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbc969-2603\"\r\nexpires: Thu, 06 Nov 2025 04:24:17 GMT\r\nlast-modified: Fri, 24 Oct 2025 18:46:01 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8400,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"49aa80ffdc37e7556604fd74ed307147","sha1":"8b0ed7474d6ce73b7234a3270629842c6386e466","sha256":"084e5e81212be4140b3a7da43b64e39ca78edc308e744e408f630e303f5b61b5","sha512":"eedf1bde63ee15fcf71d771bef001bf8e815d7800bfe2e08e2a679bf4e6c9f581699b7634ab88052e38af63f4aedc685be0d8ea5602bb12e4966e0122168d7b3","ssdeep":"192:wELADcTs715QF0D+6FDrfvsrH22RZHbJY958bvrGSW7RR0R0:PUDd1eNhRdbW9Kbvro0R0","tlshash":"84029036a6ac82de968bb1da4943d71c112cd9f4434af173acc7aedbe920a31175c075","first_seen":"2025-10-17T01:57:49.321636Z","last_seen":"2025-11-12T04:24:41.452565Z","times_seen":61,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com/mcs-images/announcement/6789vndkf5/1752737900557_6789%20FC%E5%85%8D%E8%B4%B9%E6%97%8B%E8%BD%AC%20PC%E5%BC%B9%E7%AA%97%E5%9B%BE.jpeg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET /mcs-images/announcement/6789vndkf5/1752737900557_6789%20FC%E5%85%8D%E8%B4%B9%E6%97%8B%E8%BD%AC%20PC%E5%BC%B9%E7%AA%97%E5%9B%BE.jpeg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 111124\r\ncf-ray: 9991a8a0dcbe0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origSize=111132\r\naccess-control-allow-origin: *\r\netag: \"68de41f8-1b21c\"\r\nexpires: Wed, 05 Nov 2025 23:19:56 GMT\r\nlast-modified: Thu, 02 Oct 2025 09:12:24 GMT\r\ncf-cache-status: HIT\r\nage: 434075\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":111124,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 735x490, components 3","md5":"9ed007300e8ebb498bf4b95e7fa85489","sha1":"3cd450bf78d4ebb91e66638378d936266458ef75","sha256":"e11f0cb4a2442226872e354296114d8df9f210f6e4e9e72d1d8039fb04eb8c97","sha512":"b08d0b8fd879bfaf622f2fabcda8016c353010c35def1d7227baae4a862c19f92df3b000b30729a85b7d81e9a84f65bca720a639f7b0553e35fa3a90803bd273","ssdeep":"1536:9b2nSV+LdhDPXUt0SzYjeQJ7b3JDjw9V5QOr5oIKSH12+tkrxj/vh0nu1WpW925T:CWAJPdSC97b3tjiXKX+yrZCJT","tlshash":"d6b302b8f5cf1663dd64c1b320556b08bf20db2297a4664caeacbf24510e8de5bf0563","first_seen":"2025-10-11T14:45:29.081141Z","last_seen":"2025-11-25T06:20:34.140749Z","times_seen":25,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/MCSFE_getMerchantAvailablePromotions?","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/MCSFE_getMerchantAvailablePromotions? HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-app-trace-id: wgt92nw502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: REWCEN3\r\nx-elapsed-time: 3\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IUsmDnR6bVe9%2Ba%2F2FPW2Zm9fkxpTdUZwgf6jPD%2Fcxwv6i%2F7lOtqtyCTJscBubq%2BbBfns%2FGKH3Pod53Fvp6VEWNnJk8tTNbYM8BVe\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9991a8931d2d56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":87,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"484e66f112e7d0b73fc477c4fad435f1","sha1":"4be93b860ca462ceedba54baa09d411e63ce6959","sha256":"8e36e490a37c8149cb1e4fdad4fd53d481f1258f2e4026396405d91f56d406c6","sha512":"161b60d9ed3ce358744f09441ec4b6cd7fc2c5f0a6b60fb36c514ef0063e5a80dd2d175237cd814cb7dd9861baab912a2c90f1385d8f91b32f6c4a7da32cef53","ssdeep":"","tlshash":"04b01207050020a18291c004d23c3f032075483346033018c208912ca97f92903cf866","first_seen":"2023-11-24T20:05:56Z","last_seen":"2026-05-31T03:54:46.872276Z","times_seen":1570,"resource_available":false,"data":null}},"time_used":395,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":395,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/WPSCORE_getDownloadSetting?domain=6789.show","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.542Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/WPSCORE_getDownloadSetting?domain=6789.show HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: jgug2e8502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 2\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7rpK437iVnmQbw715wY8%2FdBYm48ZC8bNzt2knHD0ZoRJYAnrRndmPgF2L9nqxPA6koirbaS%2FRRsJ29LY0P4bemToFBW%2BidcqYmXN\"}]}\r\ncf-ray: 9991a898688456a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1736,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"aa712e4901673101b6dd75af4af49a3b","sha1":"d2836f11b98a48ed0aab1e04381aac8c0fef3a64","sha256":"5c29fa8849eb602313bdf4dcec791ab65650a2ba3ef2100f7a7cca7d410d061a","sha512":"733efe9d6cedaa7834d1cd98cb35e38a65c74ae621a044fbb1c3bde5fc22dfa7f49f19b9b7a463cc3989cbd9735e66e7fb9b59a60cbb0d11f495a8ebe8ce34d2","ssdeep":"","tlshash":"6131a06a281568f74cc6d548e3bc7b13201ccd7b209669769435d6b97dfbd38030387a","first_seen":"2025-10-30T04:46:21.391698Z","last_seen":"2026-02-09T06:38:35.229287Z","times_seen":36,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/MA-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/MA-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 22592\r\ncf-ray: 9991a89e59320731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=24697\r\ncontent-disposition: inline; filename=\"MA-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fdbb24-6079\"\r\nexpires: Wed, 05 Nov 2025 18:06:29 GMT\r\nlast-modified: Sun, 26 Oct 2025 06:09:40 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22592,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"674394e0f66a0f0dd222e018d9f893ec","sha1":"9b3d40d2de7ec54af8e6ede455a27f409b5b7865","sha256":"80bd4286a962e0e67ce60aed6b9740bc2707ddfc001dece78a0c2827b12a9a5a","sha512":"bbadb39e3ed5bffba20b5faecfde153b6a2733267736eab9525e4deb406030ce1ddd6d2b7382f8fd6e8d36cde8dae9679d8950590dc1ad402bed3d1774b4a4cc","ssdeep":"384:1fkvBmlbvngp4zSRWjvt2SQ8I6D/Jfs6x8fw/tgRth1K2KinQl9m0d:e5mBvfmgvtRDKVfhth1K2zQlo0d","tlshash":"d9a2e19d00e8336cc133a7c2d2e05bf564962d2bef706a2fc9498f45849ff2ea195479","first_seen":"2025-10-17T01:15:15.058313Z","last_seen":"2025-11-19T04:37:15.62713Z","times_seen":94,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.027Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-327\"\r\nexpires: Thu, 06 Nov 2025 07:26:32 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8950da70731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":807,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b463ac712d6e450623473a6352f82e2d","sha1":"833bc6374152a8008b011fd8e2fbe7df45d250de","sha256":"d84cf3af6d781cba96b0c52af195f6e9989698cd27a7b0921a0ffbff022f5ae6","sha512":"73cb85fd15543d85d6d980e1233f92ca39cb021aaef2e75bd7c01ec6b94a3d364ceffb978a3ded135406f4603f2384f749bcec942f14221792302b9476b3c566","ssdeep":"","tlshash":"e401f17454e9710d4d0283b49f5e75b016be72fd724942deb4580532230e7cae8d7fa6","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.119452Z","times_seen":74,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TLG.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.166Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TLG.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Wed, 08 Jun 2022 11:45:15 GMT\r\netag: W/\"62a08bcb-2d5\"\r\nexpires: Thu, 06 Nov 2025 06:20:20 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 413053\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8957e5a0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":725,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3dcd3e1813582cf87e3a0fb07a91928e","sha1":"3884fccb8cf2f4f941395361c0660be8475514e0","sha256":"578d8002d750bbf7b90f801cde62b0e9dfe575766c3de6fa61e097eef5b710ad","sha512":"73f47023afc1659a6d2f2a50e3640077f4a48752ca380b658f164ce0e0dae3f43414d97479676f66e123cf64526410a579975f100c8bb768793fff73333539b5","ssdeep":"","tlshash":"02019744e5a8315cad0a9f50ce2c77f720bf7029a1d005b861a4ac0436076cba5c4ec8","first_seen":"2023-08-04T17:10:05Z","last_seen":"2026-05-30T23:44:37.091944Z","times_seen":762,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/slider.d420e4d3.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/slider.d420e4d3.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69044880-7e10\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=voeBs%2Fg1E4OyOcYL6u0qsdlHMMiNW%2FG82H%2BbvDmzINy6sK3S6noEXYOowZhqUf5QyyO%2FB7LYY5w9cFGjUFf1UX9E3dLN61E54jR3\"}]}\r\ncf-ray: 9991a8a0dc9056a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32272,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"d420e4d388935ca74419f5edf6a4b3a8","sha1":"bacc1d0c5ab9314441b2cdf2943a292e4e579398","sha256":"7062323b9c3f6fbc07887ff7baaedb379d6836e7bfe70d7747025729598ab49f","sha512":"1669328f8a562f8be4195a3f484b2167f031d539fd07ae2d8566844e8d49f414438f0307dfb992f0286cbf2beda3fca20b11f5dacd8fe65b6bb96c064c4985df","ssdeep":"768:gXE3sT/57tbDWuZMiRPidEB5Sn55+3WjFQSjWDNGL:gUqWiV5Bm8NC","tlshash":"86e21f0a6bea6570a513b0aa5f5f984a7634419f8d06ed887d5c86c44f0dc3c92f2ff8","first_seen":"2023-03-07T12:04:53Z","last_seen":"2026-05-31T04:40:23.080702Z","times_seen":2228,"resource_available":true,"data":null}},"time_used":384,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":384,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GM.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GM.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-1bc\"\r\nexpires: Thu, 06 Nov 2025 07:26:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8969fdd0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":444,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e00cacd6dcf7f6b4a1c1caea6adf78d7","sha1":"33b950ff4f5d884d542f69f0511876ee891ce223","sha256":"672096bab8fb6859612d2973fc46cbe6f17b942da8e58ef258348c6fb9ee7bd0","sha512":"03221b27204ec26561dd9f1ded9cde18cefdf91b26b887ef6cc2773009115fe43de3c5e8aaaf0584e15145cf81ade1c343fd1f57a90999aed8190cc1cc3e5534","ssdeep":"","tlshash":"abf0a395967c740ced0047d45f7e72c650f3328821f543eef4801520200e3cf5c426ea","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:55.956187Z","times_seen":75,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/HK.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.052Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/HK.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-2c0\"\r\nexpires: Thu, 30 Oct 2025 07:12:27 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8951dc80731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":704,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7667be2ebe66da6b43405536358a48dc","sha1":"154321526da2ec89bf0d184f4d0718995275c64d","sha256":"050572c4702c51dd080efe7c0d3860163d6784e16216cb4df9cfb9b1d212d87d","sha512":"859643c3b81ce715b3dde5f534eb4d2c82609639021bce507124aef63b1eb02d9222eadeedf953c560841bcee819ad531eaca06986284c08ce75ef4b6e0756bd","ssdeep":"","tlshash":"d801dca9d3aa013cdc9543950b3d70c12f6f304c73b5122dd9981a3870852edb24bdd9","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-22T19:21:41.08212Z","times_seen":182,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/RU.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/RU.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-154\"\r\nexpires: Thu, 30 Oct 2025 23:50:31 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8962f270731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":340,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b7e32f2afc2bc24a4d45cec6fabd384d","sha1":"3c6b9ad7bd7fcd2ce787624fa26c7b0289c01a28","sha256":"67dcc1c12ceeb3c8375491f3c3efd58b7f40bf6a9491dd8188666d781dcd50b6","sha512":"0dbcb6174f227b6701763be216d1d260ceb8171ed6952456be9fd11ba3a58b85d5fd2142eaadfe53e9b54d861dc33b6111128ed03cd0e6d84e2531421bdaa765","ssdeep":"","tlshash":"c9e02051d0f9770c9e114aa45e5df4c544d7b18c21c8038df0500914a10d7cb7c45698","first_seen":"2023-09-19T06:13:15Z","last_seen":"2026-05-24T08:50:29.164739Z","times_seen":106,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/UZ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.289Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/UZ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-55c\"\r\nexpires: Thu, 06 Nov 2025 19:39:31 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8964f4a0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1372,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2c99360b398906120f6265a5a5915c36","sha1":"4e50dba7e26bf1679ae40aafb3b2f5f30840aba3","sha256":"d058391ed4f7c197c8ab92192fa4d5f764cd951f88eeb340bf588f65644a7930","sha512":"3b23d1710a23a39f07f54439402339ffd7a31079b3a4fee2c7607f3a9155ffb19083ad8c31dc70fd308f81690459225aca5b897678b769289a74fe766a2b538b","ssdeep":"","tlshash":"16216fb8f5e0512cbb032bb0e78778d2c59f26c2ddd68096a578ce280126dda491eccc","first_seen":"2023-06-15T18:56:32Z","last_seen":"2026-05-16T11:25:56.173166Z","times_seen":82,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/GPI-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/GPI-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9532\r\ncf-ray: 9991a89c6e980731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=10909\r\ncontent-disposition: inline; filename=\"GPI-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbdf8e-2a9d\"\r\nexpires: Wed, 05 Nov 2025 17:39:27 GMT\r\nlast-modified: Fri, 24 Oct 2025 20:20:30 GMT\r\ncf-cache-status: HIT\r\nage: 382087\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9532,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b63f73f689d524e64325f873a43d052a","sha1":"52426fea76f583a52a1a630ca753e0af3fe4c367","sha256":"120ed48f13c09a51fb8ebefcb25e85cbc8b15b393759494eff2659017b7bd088","sha512":"65c3c42cd59617b5f9ca05ce1846da86398afdfd48bc2ff9faacc09b795ac3b45bbb487e33acd2c6900197870ee4512a970f674afbea038119c91d6ae6271d45","ssdeep":"192:HV8FNvqb627Wqt1boDlWa218VzYU8gqOBTtY7quf7NPsuTdtaRp+flhfkfFJcmNK:X7WS1bglUgzYbOZm7qgJdtap0TktRGd","tlshash":"b412bfdeef74f6381127600190e0ddf980f588a5016ba82162f8247cff7c68d54abb6b","first_seen":"2025-10-27T02:34:08.415313Z","last_seen":"2025-11-12T09:10:09.199973Z","times_seen":42,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":15,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/NLC-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.729Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/NLC-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5518\r\ncf-ray: 9991a89e796e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=6388\r\ncontent-disposition: inline; filename=\"NLC-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb83bd-18f4\"\r\nexpires: Wed, 05 Nov 2025 18:02:45 GMT\r\nlast-modified: Fri, 24 Oct 2025 13:48:45 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5518,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cfcd9f2aea578b9bf90a22524303d67b","sha1":"26ffc0e860111dd7657de567aa74487c1c10fefa","sha256":"9374fcbb99f15fb38d57cde9c23d32d8eaca65abc1a76319ff9fe51178c9607e","sha512":"0a3b0f555523b6ab442b9674dc97344968003738fcf7dc40f6605fa9ebdd8ce957438a1ad541568de8608f38c07f6e64d5955b8a2ead3e50966ba40dc7b4573a","ssdeep":"96:aFqoPbubPfJBVCbJZ7cXiqnzHBYQ0eu+TBhdWKIpjl3qao5mvHV:IXcflCZ7cXiqzHzbBhspjl3qao56","tlshash":"02b19e0154a4a3c423cb77dc8ebd8a3699dcb4fac3d8475c2d23d9a2023044a241cbae","first_seen":"2025-10-16T05:46:52.768195Z","last_seen":"2025-11-12T04:24:41.616646Z","times_seen":73,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/ac-wps.3b072057.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /ac/v.1.0.1/manifest/ac-wps.3b072057.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 30 Oct 2025 14:59:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69037d40-cfb0\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Fa3KDjkxa1vgf2ufd9CugfApAOgC73hRehu4RsE6rdf%2FD3sFiDn0MyVEla%2BVrxOOv7PEZxGwfHQVgEIoTE%2BgShOcPRRSo%2BQ1hz%2BB\"}]}\r\ncf-ray: 9991a8a0ec9b56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":53168,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (53166), with no line terminators","md5":"3b072057f27560d0f025bd2ff4597697","sha1":"840f07915781d5d594a9b305ab44b047c01268d4","sha256":"2473cc0c67f26af070a2291c183b35d3504019f9067e5791b501367438aef5e8","sha512":"bfbfe48d61a55555b7a264070c2682cdf67429f3d48551ea6db2e699b8a19ebee8ac88c62e0973bd823049b6cf8a99507e5b941055ea73a206142676bf970c3e","ssdeep":"1536:USCAKqw8hylWOdSf+km+XR0w10Ok+KNWHR0cR0uRGvfouzX:Unz","tlshash":"0d3333c8f881ad8f7567753acc6f6b1d05377b4de0700eda818b656a1eb144da023be8","first_seen":"2025-10-29T02:20:53.469664Z","last_seen":"2025-12-01T18:09:57.843202Z","times_seen":138,"resource_available":true,"data":null}},"time_used":604,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":604,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/FR.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.156Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/FR.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-154\"\r\nexpires: Thu, 06 Nov 2025 07:26:33 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8956e400731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":340,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"dc3c45c4e531d31397b4b378354d476c","sha1":"e167dbcc544e272498a5f3fc90135e958e0c4934","sha256":"1d0c12a2157fc4a25fb7eb4e989b7555289c118fcb20c5eacebbfe0dafcbe30c","sha512":"0f37a6204898e959068d8774e8da9110ed0530ae904b37bf6c52b54580d34b8bce0e29ec37907fae38e67a2855769f698f0f3b3f0ed52b18ee7cea838cb6300c","ssdeep":"","tlshash":"e3e02072e1e87608bf454b642f9db1eb0597334c21c5035df4c41911a10e3cb7a4165c","first_seen":"2023-05-25T21:07:41Z","last_seen":"2026-05-30T10:59:04.306523Z","times_seen":457,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/v.1.0.1/manifest/lib.core.min.f61a81fb.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.909Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/v.1.0.1/manifest/lib.core.min.f61a81fb.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Wed, 29 Oct 2025 03:03:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"690183ed-43009\"\r\nexpires: Tue, 04 Nov 2025 06:31:22 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Jq3A7fsGUZAJHCInUUMZ%2Bit3V6T0w8w7hqkiw6tTdgvLmOabEt4r4BBxIbpMXDH8NYySO4hOB5YAPe1NDtP1eFia5gBpQo4rWp5d\"}]}\r\ncf-ray: 9991a89aaa2556a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":274441,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"f61a81fb0aab81d607fd1f0faa0c6ec8","sha1":"aeb84ec03ca975b50228c322785327132f3d3741","sha256":"fc2572f1760c2d9e7929946025af8093b20d1828c4af8fac29d0845714926e5d","sha512":"a96bbc97b60df69c4595c63fd22196e4e4c7dd50e6c4c8a516ed959699f70ee4373da19b11e567e7a8020ef470e3d370b98ba9813f1b5b2c5e59906079a83704","ssdeep":"6144:lHtsLOg1Dg34cIYhrSTaDgxo+/7zyISSaMrb5t9vz5aS9QF8gVSShYkZow91WAW4:SFDC/Iwr3DKN/7ASbr9EZow91WAWkgDc","tlshash":"e1441caa584222cfb51b4936d7c82ff4433dc65394621ded72c62c4ac785ffa62ea113","first_seen":"2025-06-06T19:31:09.879041Z","last_seen":"2026-05-31T04:40:23.171514Z","times_seen":1871,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/PIN-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/PIN-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4950\r\ncf-ray: 9991a89cff4d0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=5875\r\ncontent-disposition: inline; filename=\"PIN-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb84ef-16f3\"\r\nexpires: Sat, 01 Nov 2025 01:19:54 GMT\r\nlast-modified: Fri, 24 Oct 2025 13:53:51 GMT\r\ncf-cache-status: HIT\r\nage: 493626\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4950,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"20df18595fdd5b79e7612fc874f01bbf","sha1":"205294533d6d29a7e5f5ab1e39eeb135e66d8806","sha256":"da9138beb42d623a7a76101e5f9bc68aed4b451f857a06ac9c390a63abcf648b","sha512":"d050f53aed3dd73bbafa2bceda4cd7e21cb78c8dada8382735e47d38d27946d4df149ea5755b556f253d544ee267defb5b07695b9f5e988e098bf43e1a04faf0","ssdeep":"96:VVayPIltmuCNm2QW8TxJ3DkCgy9kbjUv4lC7DL6gYacQvfLZTL:XaywlAc2QW8dlDBg9boxZcQvjJ","tlshash":"b7a17e16633b0ba72fae7daf63dec5842c5d01501c20a32cc99439d98a1189eb1a5dce","first_seen":"2025-10-14T07:32:51.341627Z","last_seen":"2026-02-28T04:40:49.698552Z","times_seen":105,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/TF-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/TF-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11486\r\ncf-ray: 9991a89d6fe40731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=12770\r\ncontent-disposition: inline; filename=\"TF-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc38b1-31e2\"\r\nexpires: Thu, 06 Nov 2025 23:36:28 GMT\r\nlast-modified: Sat, 25 Oct 2025 02:40:49 GMT\r\ncf-cache-status: HIT\r\nage: 231995\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11486,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"3af30ac9e50196adacbb6362afb6516f","sha1":"d2431dacf659053b2a264a669649378277c37537","sha256":"bd3de200ad36a024f2c47021eea7735192238db5c7ebbc6e7ec70b0b8a3cd862","sha512":"4fe3ebfbf0b5166f76859536cdeb6082fa9467f05903dae161a4f5a89a274708f675a8406eb1b2f23578904a533d1df1d3528088d32844a9504198af220d25b0","ssdeep":"192:K5wvglZYHXKpSofPLlhX9ry3iavRfDZ8AJQxlw7L65oNsJ79q7b3H+S4wT:Ywvg/Y64oRh5nav7nRL65oggbuS4y","tlshash":"6a32c0b93c69a36f37a45c1665c845c171f03c60d843a2cfb439499ee8a72381793f2e","first_seen":"2025-10-17T01:15:14.92802Z","last_seen":"2025-11-19T04:37:15.483756Z","times_seen":71,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/FC-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.532Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/FC-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7806\r\ncf-ray: 9991a89dc8670731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=8693\r\ncontent-disposition: inline; filename=\"FC-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbb4dc-21f5\"\r\nexpires: Wed, 05 Nov 2025 19:27:01 GMT\r\nlast-modified: Fri, 24 Oct 2025 17:18:20 GMT\r\ncf-cache-status: HIT\r\nage: 421443\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7806,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d53f6bcfc9d321fbd5bd6bff33dd559b","sha1":"f35c9baff02ee305b38e79843bdc47ed8a03a520","sha256":"fbe8dececccc1bdd199425312ca701e7f7708c40175259ca34a893673b6660f5","sha512":"e389ffbe3962503702cef6d6a60d933146934def2e4144111b5e0e2b83d19fd1c2ca726ab7474e7dc0e19140dc2320a8b1382fb3367d5bdf7747d07cca4ddcca","ssdeep":"192:jLxLcx/DTn1OrHb5sgBd4p4xlDgmSYXMaPV8sOh:jLx85OH5t4pufcGV8","tlshash":"f1f19e5f6f8267946f6a353a4ca0fbc5b8e197e8f8581ca561438dfe1b302c780d580b","first_seen":"2025-10-17T01:15:15.315367Z","last_seen":"2025-11-12T04:24:41.457981Z","times_seen":83,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BTG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BTG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 12060\r\ncf-ray: 9991a89df8c50731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=12962\r\ncontent-disposition: inline; filename=\"BTG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc40cf-32a2\"\r\nexpires: Wed, 05 Nov 2025 18:06:29 GMT\r\nlast-modified: Sat, 25 Oct 2025 03:15:27 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12060,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ef7f118df61a72660a5a9903593ef687","sha1":"c91b62b813e30c806564fb946c116f5f3bfd2949","sha256":"6b63717f5e1b1be80fa30d42f00adbf8e3f85796baa4fb3686f35aa041d60754","sha512":"acb626d3e2c7e81c491a4602527c07575055fb6378815996a303907c741cde2a729e10f49ba4c956cfab5f9986744f2e79c4c18ca386961c12688622325b8b93","ssdeep":"192:dzYRJ0R92uewojlaIHA0ptl436v4hoqFigMrExMoERs/tV2RDaP7A5zma9JtFdWK:dzYpuWLHAYtlO6wrdMwxMoEYV2WjA5pT","tlshash":"a842befd754e7fc07b08c86b81ad3876a5c7056dde017a0e190f56d17832f0513e188a","first_seen":"2025-10-17T01:15:15.623876Z","last_seen":"2025-11-19T04:37:15.65618Z","times_seen":81,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/GFG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.658Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/GFG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 16788\r\ncf-ray: 9991a89e39110731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=18999\r\ncontent-disposition: inline; filename=\"GFG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd52fe-4a37\"\r\nexpires: Thu, 06 Nov 2025 18:01:58 GMT\r\nlast-modified: Sat, 25 Oct 2025 22:45:18 GMT\r\ncf-cache-status: HIT\r\nage: 381707\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16788,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5041dcc40a9a3da7e1c389d82794da11","sha1":"b638213c1647905c1a4d66ce3d9c94b95a5011bb","sha256":"884bc57e8bc024e920d495820376a7bd452cbe2c3f1d4e292c23920cf710be9a","sha512":"5137fd47bd9cee2404ddce5171eec93f79afc096647339d8e1cb467defc0ce8fc205ec13443d3c95fa9433f86d35d7183e698b81515b690c630e8144da28d575","ssdeep":"384:baiUWW552yoT4MWLAsBZXoXzlbAue9seL43P9oyWTVeAgT37T2NrUM:baRTEpT4MWpxyJUx9se+PiyWTVeAgTLK","tlshash":"5d72d01a9be40f1a8cd888c2717d399b50a148b7f653c6227855e331513af36ee06cf2","first_seen":"2025-10-17T01:15:15.506342Z","last_seen":"2025-11-19T04:37:15.595638Z","times_seen":75,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KH.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KH.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-1e4\"\r\nexpires: Fri, 07 Nov 2025 00:31:37 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146629\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8949d290731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":484,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3a7a7d57d2692b90ec3663b258211ba0","sha1":"45b02ba80c3b93fc0828a4ddce712144e6e85632","sha256":"6d8bd1763024f1765f8160674aa60ae214d0dc4c882e6b58ee57a75d75772820","sha512":"4f8e7152a9774a7207c24b0cf5aa4b883f4dbe9d72600609a05920f19dc4d63807833b4b979c1b61c225a0da1808143fa7867335173babf4687d9e96de0f0a32","ssdeep":"","tlshash":"6cf02752f0756b4cee9249f4bb5ee1e51497234a39c906fea8842932740d7ce284aa9c","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-28T04:17:24.923184Z","times_seen":111,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BF.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.318Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BF.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:50 GMT\r\netag: W/\"643cf38e-18d\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8966f8b0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":397,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0679153f1422163537878563d8a0c6a4","sha1":"42bf81418c4b8625fdab8c34fdb183d0a650aba4","sha256":"e2137f17900c1b2fbfee2d04e6c7a729a2395b2f6d837050f5c1d636cb22cb9d","sha512":"1daa551f2d73bcfcd5e90e5cc029203bb15b5dec4d36965f3d30fe3129c424bad9f281f316aa3f0828aeedfbf957867ff30f9fc89e1431c022997371dd5b5b1d","ssdeep":"","tlshash":"cce02b9090f4760c660843b82f5df9d2a4d3354c73cc028db0401516615978f3d8da58","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.13094Z","times_seen":68,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/captcha?","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.004Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/captcha? HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: x5cc94b502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: FREEPLAY3, COMM3\r\nx-elapsed-time: 3\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vp9mapXrYWHmZXBK%2Fy3kjVbpdRSUfY2h4HyEwbXYz46RHNoeeyynwdbib1eszCqGz0byQGvT6WgM1yOboJM1m3rK8iGb6KNwGpPx\"}]}\r\nset-cookie: captchaId=745eef97-164e-4244-99c9-aea79119e64f; HttpOnly; Path=/; Expires=Tue, 04 Nov 2025 05:22:49 GMT\r\ncf-ray: 9991a89b4a7256a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3883,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ccec9a920305e1ff60b854c3e5120950","sha1":"acc6abb97d8bb430ab8246c980bb9f99a856449b","sha256":"eac5fe24587c33d62455e37632a5172bfe4d26ba309e9490f90e962002ffb2d1","sha512":"ad37afd9128d3c11cf888843e6f3723cfa2bc063ef9d1f72fe11301b2a646fcc7817d1ddf9dd726dfed89f6e29a5b4b0d39293a3dcc4bae10e1c917414129aa6","ssdeep":"","tlshash":"0a817d6659012e30fd6fa9708641f2a1bfcae0ad604d992bea0255091b6fef508f8404","first_seen":"2025-11-04T05:20:58.375544Z","last_seen":"2025-11-04T05:20:58.375544Z","times_seen":1,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":205,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/dirty.294caafc.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.916Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/dirty.294caafc.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: accept-encoding\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VOHLEZCqDzKYHFofssXherBjFiCStZ6gKXwv4oHEjSQEG8AzUUTDz3z5VpG8g79ErZxADQLrtu5iacIwb%2Fs7bi0mRKQyxIzWoqLM\"}]}\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\netag: W/\"69044880-58\"\r\ncontent-encoding: br\r\ncf-ray: 9991a8a0dc8d56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":88,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with no line terminators","md5":"294caafc2b317da7ff6ce46597599203","sha1":"8e024724982b0c2398a8144d7998b6a7fa6f232c","sha256":"2b0b5c66c39bbe4ade93ebb6218e3ebbce3a9d3b4cf8b749300a78f577445ba1","sha512":"c2031300a088bcb666bc8d123689ecf8b59491093f3ef06d3215925dc2b605050448f05b6125711e0d9754154a8dfdd9327ea2e0d7ed654aa51edd7827847ddf","ssdeep":"","tlshash":"66b01220738c3502c334461aa6185f54323372c3cd0a303c1806470218f03200244144","first_seen":"2023-04-19T14:52:23Z","last_seen":"2025-11-04T05:20:58.376327Z","times_seen":1074,"resource_available":false,"data":null}},"time_used":565,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":565,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/assets/resource/GIFT.75c0150f.webp","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.689Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/promo-ui/assets/resource/GIFT.75c0150f.webp HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:51 GMT\r\ncontent-type: image/webp\r\ncontent-length: 609486\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 03 Nov 2025 07:10:43 GMT\r\netag: \"69085573-94cce\"\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: EXPIRED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=9qkgDsxD%2BGxSU6fryfwGIbhazsOfwinK70qTS8TL5ty%2BvS%2BiVi2LsArgwbQsAv6DqU8PTWAkigiTnKd0lya1FE2SvBdDmXzodvRW\"}]}\r\ncf-ray: 9991a8a5ce8156a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":609486,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"34d0db7bd69b3956225a7f49fc896b06","sha1":"8fb7628cb6c07055c28084310ff6da94407d0482","sha256":"f9e08440c7cd4fc4a19cf8f5d46057de56a6b3d9245855b34fe7e2cdefaef1df","sha512":"b6364a74ffc90f0c89e4fe6c381af2bde42d7443f047b6363c56a0022caf073141c5b5b7c324e27c4bfe51c5ea96ec5b149ca392552ab7fcb9d661b632ef3be1","ssdeep":"12288:Hmw3DC3q2hEhPZpx+i+Qd0Ie8Cuoprc0I7EFTqVUiOB:HmKu3hWXMx84rc0BFCOB","tlshash":"afd42355e39f99bac039e735e04fad61ce03e9c64895ef5d4899e2fb058f22bc140368","first_seen":"2024-07-11T14:40:33Z","last_seen":"2026-05-31T03:54:46.691934Z","times_seen":1921,"resource_available":false,"data":null}},"time_used":1314,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":377,"receive":937,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TW.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.073Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TW.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Wed, 30 Aug 2023 05:34:44 GMT\r\netag: W/\"64eed4f4-2c0\"\r\nexpires: Thu, 30 Oct 2025 07:12:27 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8951dd60731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":704,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7667be2ebe66da6b43405536358a48dc","sha1":"154321526da2ec89bf0d184f4d0718995275c64d","sha256":"050572c4702c51dd080efe7c0d3860163d6784e16216cb4df9cfb9b1d212d87d","sha512":"859643c3b81ce715b3dde5f534eb4d2c82609639021bce507124aef63b1eb02d9222eadeedf953c560841bcee819ad531eaca06986284c08ce75ef4b6e0756bd","ssdeep":"","tlshash":"d801dca9d3aa013cdc9543950b3d70c12f6f304c73b5122dd9981a3870852edb24bdd9","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-22T19:21:41.08212Z","times_seen":182,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/EG4-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.246Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/EG4-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5892\r\ncf-ray: 9991a89c6e920731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=7154\r\ncontent-disposition: inline; filename=\"EG4-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb94c6-1bf2\"\r\nexpires: Fri, 31 Oct 2025 17:19:51 GMT\r\nlast-modified: Fri, 24 Oct 2025 15:01:26 GMT\r\ncf-cache-status: HIT\r\nage: 375395\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5892,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b2ed37d0f0bebe37d9821cd600a8ca8d","sha1":"d0343347583d2c5c31c690f7bb026c5ef7b21712","sha256":"9e08d10fad9575e82325bddb022ea1d4411826da5093011dd100a79f14d58bd1","sha512":"bdea4a46b0e3014b7f7a57980b0f05bd952975c192c5d37e61a66d42e87df807d127502c1d2e47fe1fb354d2b5e7e646aa9b441d5ff1b2cd0c0e0ce66c2c83de","ssdeep":"96:MjMCqESxTrTwfJP7DNdOwlN8qH8bpDmrQzCQu1s7uz2TDyaf3HU/x5N4la:SMRbGJPyw4IGDmrQCkTJHU5Ga","tlshash":"4fc16c0475ca67af68a903964603089e87efa6e05920ea1ee2117e267500cee264a839","first_seen":"2025-10-17T01:15:15.017623Z","last_seen":"2025-11-12T04:24:41.654868Z","times_seen":70,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/drop-rng-img.ca00cbcd.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.518Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/drop-rng-img.ca00cbcd.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/png\r\ncontent-length: 43255\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\netag: \"68f70d0d-a8f7\"\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:49 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6%2BrxiLA1eJR3aGR17vNphey05aJXZA0i02kXNbxd97X%2FP70WLmBCMOrURouVAqMWW%2BbPo2PiOuP3affbgp1octDM6B2%2F7mHnLXp2\"}]}\r\ncf-ray: 9991a89dbb7856a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":43255,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 458 x 447, 8-bit colormap, non-interlaced","md5":"ad562d276d0ed4efe641cee39af863bc","sha1":"aaefb3ef1231b8327a84dc0dfa319830050f4933","sha256":"bab65c5f6f84685bb522b052cac9d2f57eb284846b9169c3da9229a7de5b5147","sha512":"ba52dfd279afe2ce0a3f9bfaa1beef6ee23b895c93f3e2ca0fc4ea5eb803ec26259f484eba278150fb6b855edd5a4baa942345c1134ef680d81e4317031f59a3","ssdeep":"768:lZSm+jGJ5fXHHUxqZEGMK81FGdAQeiZhOWm4HvdTWQIi07zrnLskYDem14isaK0u:lZzXHCqZERkIkViO0vrQkGeV4KLP5","tlshash":"4a13f1b67fe2b919c7e76b304189a595044374cb806701b1f78f15ee23e299d1f8a13d","first_seen":"2025-08-18T15:26:48.998068Z","last_seen":"2025-12-15T03:55:58.49866Z","times_seen":68,"resource_available":false,"data":null}},"time_used":1089,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":577,"receive":512,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/system/country?","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/system/country? HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: kr2xuam502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vMvtp4UmG78x71a30fwI%2B5CsxXHjN%2FgCOE1LXdOXwOqaq2luXGGt9PuVOXBLHUAKkinh3td9d1niNz4gY%2BIGymBb7KovaxKcoyIE\"}]}\r\ncf-ray: 9991a8931d3356a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12198,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (11319), with no line terminators","md5":"4bc56979cf95b0d8d03264cc32596f08","sha1":"3a774c1f4171a8da2d2c3a4a9b535318b21e7a70","sha256":"17e5e1a4d497697a4c3d577bd1901cd510e783328b3769fd9f11e679b135e8e4","sha512":"7c31d60cd997520a14acfebcc1afaee221c51ead21b27394f422685ae4faa9d8bdd884b635d3c8a87ad3deea3bfe6cb1ae6bd91769e7bc40c776c123071e2d21","ssdeep":"96:l6jOZwkPVnUSDUx5hxFDJxk5ViPDFthda8fTL6lkD+kavc/o9Md2aWPaCKxm5OGV:lwYRgSHwxwwV51RmT","tlshash":"8b427b3e640ddfaefd36ffd9704f362554362944d2b8240acac057727b95afd21210a8","first_seen":"2025-10-16T21:47:57.532181Z","last_seen":"2025-12-10T22:44:05.953562Z","times_seen":64,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":385,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/LR.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.372Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/LR.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-2db\"\r\nexpires: Fri, 07 Nov 2025 10:24:39 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896aff00731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":731,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"03762e2d6b0bc5ec8323aa28ef04a9a8","sha1":"907ff3808a3ed11c0554626c5a181081c3fc7e62","sha256":"846bcdb2a03133d817705fd960135262a7369e040144f39748b5a14fd9b1820a","sha512":"ed714b8139973824ab31d3f70d948175bf132df0652e6538e465f94ea6a14edcf6a32d71031846e08098ebdd8e765702396c69aa160e2215f1028258b8e9df6c","ssdeep":"","tlshash":"6b0144b0d3f623b44e0047f46b1db5da3553d258315a32afa41900307028bcf988c6cb","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.005745Z","times_seen":70,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/v.1.0.1/manifest/animate4.min.acc54486.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.599Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/v.1.0.1/manifest/animate4.min.acc54486.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Wed, 29 Oct 2025 03:03:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"690183ed-11847\"\r\nexpires: Tue, 04 Nov 2025 06:31:19 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wMkyNTEiQz0XhwHlvwHxefDgDYccKpA1ib5SwEHeET5PntIgJ4PaHHhCTYqvKsYVAOBE3qutjwros%2B5hOvluK5LOudKNL02QRN0A\"}]}\r\ncf-ray: 9991a898b8f356a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":71751,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65348)","md5":"acc544860202ca85bd85dc0429880450","sha1":"ab2e786b8f411e124e9fbcbc02f323269beff034","sha256":"721fd25fad2ceea766b483f7692fc840097de75bb54185273920adf62da63e15","sha512":"c1622f9f6e9a38f6e7dd2b5ff0fb6a188f432d8f2d9670b98f7c842190fb3b7faa29b54f66e87ff15c7b741d7c65f52deda428d8bfc76d9027c4cedaf1b16655","ssdeep":"1536:h6uNQ3fdPwwanleMf72yMPkZ8PFwh1nAukdDO3Xyr5Ir5eh0dTy:AkZgwh1nAukdDO3Xyr5Ir5eh0dTy","tlshash":"3a6329ae4891128990230f6787cd5ea84b3dc6a355721cee33552c0b8b46fee73de617","first_seen":"2023-04-06T01:49:24Z","last_seen":"2026-05-31T04:40:23.219165Z","times_seen":2555,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/drop-fish-img.cd6deaf6.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.755Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/drop-fish-img.cd6deaf6.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 53947\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\netag: \"68f70d0d-d2bb\"\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:49 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xzuEEGkRxFylzdmkwndGp5X26D32N5BiyPMFLJDNz3X0qC%2B5okS16jE29eoJR14P%2FjVKb8SfwwWleVcSjx1iiEYKdqXjkFJv5ghd\"}]}\r\ncf-ray: 9991a89e9bd356a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":53947,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 458 x 447, 8-bit colormap, non-interlaced","md5":"dcc2f9f90f84a70b090e4871a434df10","sha1":"3daaa5d9a929bb2591bf164fbb8fc2fdb572c811","sha256":"e06292db22a592804e4e189eb377c4cb88790bfdae3534d8c5a040dbe65ccf9f","sha512":"799ed4bb4a559cae6dd44c00d47dcab1750270dba1edca4ae728c0b62810e90c53162d19f92dcbfc1eb636b4d41d80a8e0648391d9f44876d9c16de5ca2b3863","ssdeep":"768:pHK3Ha8euKcaWBTnSWTAXTRW28oBiTGfk/LmQUp7lzsvSizqOP/tKmadBVo3L2L0:dKXabAB7NsDR3vBi6fk/yQdS6qUWNSf","tlshash":"7e330273708dd0e78a8d4eb1ef1b22a1e1111176a7844ed99b8fe3dd3748f94214629a","first_seen":"2025-08-18T15:26:48.935397Z","last_seen":"2025-12-15T03:55:58.547292Z","times_seen":68,"resource_available":false,"data":null}},"time_used":1115,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":567,"receive":548,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/css/chunk-vendors.afa4c923.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:45.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /css/chunk-vendors.afa4c923.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:45 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0c-ca32\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 06:31:13 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DKste%2F06djTMajJ6IGfPR%2BaqhhJayyn1PUKpzvSOeXUo%2FJQ8KeWz8Wbl4nrUCtRpwvFCqnT0S4TZoi0v3k81j4Qrgqs4kutkcEdU\"}]}\r\ncf-ray: 9991a8836e1a56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":51762,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (51762), with no line terminators","md5":"8dc263bf13955ad4da61d4b40fbe404d","sha1":"f822c4d41a4a93a20c99b418b1fa30a9df9daeca","sha256":"94e0877f628c7fca3202e1f78b37a077b691816d81ba753462a47ee0f5dc856f","sha512":"13b0da8b736a2cde8e44b20255aa661a8d56eb727393378848f6056a405f714a4c6deae4dd702e89f272617533a6b3610d17eb33744f135eae8964d7e4e8744f","ssdeep":"384:Ec/Z//y81EG/wX1q/y5Ccfi5oemXjoV5c:f/db/wX1f5bfi5oemXjo8","tlshash":"dd3383115b00312aa2338e5947d496a8c739c793f2633eee355179c1cfd7eeb319a24a","first_seen":"2025-03-05T14:46:31.08894Z","last_seen":"2026-05-31T02:25:53.074132Z","times_seen":428,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/assets/resource/main.DATHFZ6B.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.838Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/promo-ui/assets/resource/main.DATHFZ6B.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 03 Nov 2025 07:10:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69085574-6fb14\"\r\nexpires: Wed, 05 Nov 2025 05:19:48 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: HIT\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=X25uGISoPUn1ZhdOCJqU6LVpeb2BL8qjbo1BM4rP7AmhetjGvGK0orqTW%2Bue5V9OMvuS8Q4Xq%2F83YOAGRItoZ3qsxesWhEg2OVgO\"}]}\r\ncf-ray: 9991a893fdae56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":457492,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"348cf79fe6b0b7c9dd2f1f2ced1d1e60","sha1":"f5aaeaed6c7af863aa8399d9ce80bc914f16d7a5","sha256":"ab042ad5691589db1c935aaef1465110cb2eca883e4a12bd458389d6a3d008d7","sha512":"5a1b131d752496c7c0a6ed57881781e38ca5eb1918762cc7470413fa82591c99a66c7ce5b2b6a9633f190582fb4fd121531f16c28ccdba60d5c674221a65980d","ssdeep":"12288:rulzRlIwbZIn6L58kyehqYZKL1xhQ8z0YzC:rYzLIw1K6LOehLZKFQ8z0YO","tlshash":"b8a47d339552371db07fde2897e4229e5228c127d1172afd2d927623cbc768226f528f","first_seen":"2025-11-04T05:20:58.384501Z","last_seen":"2025-11-17T22:29:09.691727Z","times_seen":58,"resource_available":false,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ES.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ES.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-99d\"\r\nexpires: Thu, 06 Nov 2025 07:26:32 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8950dbf0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2461,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2b7627ca6bb2aacc572bc37f4a81c7f3","sha1":"dc86171e18a2c16fcfd794e292b4594aa3fa89d7","sha256":"3a001c14356b470b8c7ef544144aed6db1298b95cf33303d0471afeae26f197e","sha512":"05a6811e31729051dd579ad83eb3c631cb3751afec7d8a628c41003eb36a3d0b6b18f51ed5b617e53d05d3a77cf4b2dc49771a809c5e1aa8dae17ca7af37688e","ssdeep":"","tlshash":"30519f40f47db40d4a2583e90b4e34e3079e707ab30a05aabc4c5a95da0e77fed9bd18","first_seen":"2023-05-25T21:07:41Z","last_seen":"2026-05-30T10:59:04.230367Z","times_seen":310,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ST.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.392Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ST.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-204\"\r\nexpires: Thu, 06 Nov 2025 07:26:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896b8060731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":516,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1403f2d22c59133494fd9ebe2ddff95a","sha1":"c1b51f297df1053df7380a622ae741a4aeaed553","sha256":"8063b3ef918c7e17e28b5e3de2d0880829692308f5e922bd3566b824a5723df7","sha512":"79580d07dea14deea7aae0aa8b9bc77bb157973210ccba51825c3658c304e4de9067f08dfae710ed26b8ec7ea315c4f800f497581c6c1c78b27057d8a7b364db","ssdeep":"","tlshash":"33f052a9e9b96a0dba0403f45fcef0d618e3229c11d003beb04019217d2eeabf605f48","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-10T19:00:06.490061Z","times_seen":67,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/PG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.526Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/PG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7368\r\ncf-ray: 9991a89dc85b0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=8539\r\ncontent-disposition: inline; filename=\"PG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb9b1c-215b\"\r\nexpires: Wed, 05 Nov 2025 19:27:02 GMT\r\nlast-modified: Fri, 24 Oct 2025 15:28:28 GMT\r\ncf-cache-status: HIT\r\nage: 413251\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7368,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0837641acdcebc474e9049309dddd7f8","sha1":"ad9bcd5b6bdca6c1454f31f1c99d1c7ab555d41f","sha256":"c974e26a62880858f87afa6cfff13e4b3acdd0e4a55f0219155417d20a555d7e","sha512":"5422aa5c04a6823cf54ff55ed3f6b20cfd555e6589fdbd9425d78ffd3d4d84a2d6a0d65997204b379c78795f377594bd503ecf91b39fa0abca690b054f923a9b","ssdeep":"192:cdrj4mHmemxLeXMXQBj7B/1gIHzCfkuoH:M5HljX4Gp1gIHzCfkuoH","tlshash":"19e19fc0f8f5c1f2d1b15421c201e722ba368afb15d195d02ca986dfa421be14ec4cef","first_seen":"2025-10-17T01:57:49.42234Z","last_seen":"2025-11-12T04:24:41.506384Z","times_seen":91,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/MAHA-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.710Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/MAHA-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3762\r\ncf-ray: 9991a89e69520731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=4942\r\ncontent-disposition: inline; filename=\"MAHA-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb6454-134e\"\r\nexpires: Wed, 05 Nov 2025 16:55:36 GMT\r\nlast-modified: Fri, 24 Oct 2025 11:34:44 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3762,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"86fbaa87900c85ada31e7318f19edd4e","sha1":"42e2595c86c665335ed2c8488c420279ac01cb13","sha256":"a2e8492149956b185f45b45305da170e780851ea92de21dfc2aa6763ce385a8e","sha512":"8458bfdeee731517fb779d6106baaba46dd26bf91517dd4ba27d743664cef209ec74bc434b51981f12cac9820a4ea1d1dbc780539f5a2c50baa12a4c168c3e31","ssdeep":"","tlshash":"2e717de1587b314a228a6e106fb3d9934a123cb4e26cc745f14b6d4c1ec5ac54abb844","first_seen":"2025-10-24T09:54:46.449456Z","last_seen":"2025-11-12T04:24:41.641787Z","times_seen":56,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/HB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.716Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/HB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3782\r\ncf-ray: 9991a89e695a0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=4843\r\ncontent-disposition: inline; filename=\"HB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb67b6-12eb\"\r\nexpires: Thu, 06 Nov 2025 23:36:46 GMT\r\nlast-modified: Fri, 24 Oct 2025 11:49:10 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3782,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1c41685af93b576c5f16eadf631ecf0d","sha1":"c9a660f4c9388bdd307ed51a83ddeb3d98f5c933","sha256":"dd0ddc3cfc3e7038591ffcadbe52ef926bdf26da6a619f5f2beb937c52f2bb45","sha512":"a33c6217e78e5f443f141a21b46467352ed299d6b3eebf6f3c20223aaee2857bea84062e20de37321afadc568a6cbeddd796f090d2bd3b5465129d5b9cd52e34","ssdeep":"","tlshash":"77717c94ce366b81d1221a3787b72e00a0ad9488bbffda2199d614f935f13b4d44d74e","first_seen":"2025-10-18T11:41:57.014951Z","last_seen":"2025-11-12T02:57:36.994142Z","times_seen":40,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/chunk-web-view.5f94465d.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:45.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /js/chunk-web-view.5f94465d.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:45 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0c-a214f\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 06:31:14 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self'; form-action 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7hTQ7DhEMO9bNojrM3MOpMmbjHP9mu9nDyTYrQ0YCdspEhfpIZZzFGy9g1LTI6O%2FScn71eiVWfJIQ7vj4CDr2OaMh9XF49azDawi\"}]}\r\ncf-ray: 9991a8836e1556a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":663887,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"baaaed2d9e14fd004408bac663afaaeb","sha1":"05760d6cd50b4421e521c89c26f18e6a4b57a6a8","sha256":"083887ae676afc4d9409ccb8789774c9e365dce9c9d828559dc4e615e3cb3a52","sha512":"856e10d63781b6206223690a0e3d326556ff8c5f724dab98b637a4cf51e2baa116ac60ed3b273931e473514e3b872d8b156c2ec9c1db5f869ca181e3e04c16ae","ssdeep":"12288:ZFus+31sVhkoUv7IIRRJTRS3x9efT8Fouztm41ouLO:uT1srkoUjRRJ9Eer8Fouztm41ouLO","tlshash":"1fe42c9eb1c3b1794bb36065202f3119b33b1d8464198844f635d8dabdacd5a932bfbc","first_seen":"2025-10-21T06:00:21.953039Z","last_seen":"2025-11-04T05:20:58.391081Z","times_seen":11,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TR.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.043Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TR.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-1a4\"\r\nexpires: Fri, 07 Nov 2025 00:31:38 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8950dc10731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":420,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b4a158322e521d3a0ec446c0fbd07ca0","sha1":"a2df9c2ba215697d1bf8799150e2796419fdd0ff","sha256":"7bd3ba2735afc91b82734a36e1c1d7d8bd4678412e69b6e6543b5b6ac2996614","sha512":"b245e555d41e05c74ec12078e6866742f2afb5918edcec637ea219bfc34b785d648a672c481d9f7851459fb526b32bb1b062f6818dfa4f64852c0f612612bf52","ssdeep":"","tlshash":"45e05c11d19ca73c6a1043e85f7e70a009b362cd11c6035ef4482531210fa92b976a4c","first_seen":"2023-06-15T18:56:32Z","last_seen":"2026-05-25T14:25:34.861982Z","times_seen":170,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/YT.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.437Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/YT.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-916\"\r\nexpires: Thu, 06 Nov 2025 07:26:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896e84f0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2326,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"226d5728915c117e646d8c96bf0ee908","sha1":"45284541a9be12efc03fb745fcbb1de605f63ace","sha256":"de2e65a8a3b41bd5f0d2e57dc8a4934a5e9f458e6fe5aa55fefbf0adaf0d216a","sha512":"b93c0fa93491b24aab880beb98ef47f82db3a3701004e6cec9469ca7b4f175445fa30fd7d916c41b2c2acd1006bf4132d98d69112d3f4d56fdd0e7002ae4de59","ssdeep":"","tlshash":"89414b3cd29d521ca97781a41aaa20a50b6ca3733f4941e76c6fc4f1310b6afe787c80","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-10T19:00:06.404617Z","times_seen":67,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ZA.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.461Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ZA.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-21e\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896f86f0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":542,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"855c9dc1f5bb5efe1b1a3f4f3a71a316","sha1":"5d7c1c0902fd6e9a179743455d4ca3532b8e982c","sha256":"895a8a071362e15239351e492bcfd369620cded26ce2f75e5b607c850fdc269d","sha512":"a2b16f36ec60eb1d18deb74d858a5630b5ac0c67048ff230a61716b1a71fd7c5838cea95dbf721fe53af6954cbdf245e84f72f7722ff508fe4619ebd6f6b4951","ssdeep":"","tlshash":"54f0c981e0bcb51c8e5503e81fceb4e7117b31ec218806feb0e024202209b8f684ea98","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-22T19:21:41.096559Z","times_seen":132,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/WM-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.168Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/WM-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7430\r\ncf-ray: 9991a89c2e330731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=8341\r\ncontent-disposition: inline; filename=\"WM-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fba948-2095\"\r\nexpires: Sat, 01 Nov 2025 06:20:36 GMT\r\nlast-modified: Fri, 24 Oct 2025 16:28:56 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7430,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e26f80291195c1690d1a076038eb9468","sha1":"822859c8e6c12689a1169e4def61d89511c8934f","sha256":"80aa7236d9e5281f76a6fc90a89132d9adc53f0c7bbda1c303b33ffc16c91674","sha512":"de621ba520690376a2a2b0157215e33b7b6c3666f3f6f6ec62f69e3591a56dffdc84cdc6379633d07087be70f123807d56bd8fde70e019a69c625a08e317b6ca","ssdeep":"192:WHG3srTzetvI7SsOemQxmiQLmuk2/ce47PIazAJBo+W9FB:WH6srTqmSemQxmigJk2/ceHaF9P","tlshash":"f4e1af88ed57daa5b34c82bb2b9147e8f40bb1721b3c682f36c0614e4eed71d425a19c","first_seen":"2025-10-16T05:46:53.093991Z","last_seen":"2025-11-12T04:24:41.516826Z","times_seen":57,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/MT-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.343Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/MT-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4462\r\ncf-ray: 9991a89cbf150731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=5729\r\ncontent-disposition: inline; filename=\"MT-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb76be-1661\"\r\nexpires: Wed, 05 Nov 2025 17:48:02 GMT\r\nlast-modified: Fri, 24 Oct 2025 12:53:18 GMT\r\ncf-cache-status: HIT\r\nage: 352030\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4462,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"cb9e863e0717bdbc746273f47bfbdc32","sha1":"59ab0145ae3e37689027acd903b4b7a2054cda10","sha256":"181919b938bc78feb4a1ccdb1a8fe0cd7642917f68e10592661e0ef4dc1416a0","sha512":"84f2ad766f87d675278a795637dfce3df8bb383282272970fbd3a1ae48536eb26fa45ab529822b91d72a56294f10f50cdfc904dd851d7f10bfd34afc966de4a6","ssdeep":"96:qYclE5av1r4rfiCk6eKlufm4Itzv8gcqWJG2a/9PA4eP7jue7/:1pPrfiWx4fJ6vneWOB","tlshash":"f3917da2909e49f81a4450652ca20b29940c73ec5e7ff63de6e29452d0ced87d718f0d","first_seen":"2025-10-16T05:46:54.144155Z","last_seen":"2025-11-12T02:57:36.993009Z","times_seen":26,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/AE-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.645Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/AE-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9016\r\ncf-ray: 9991a89e28f90731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9950\r\ncontent-disposition: inline; filename=\"AE-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbcc3b-26de\"\r\nexpires: Thu, 06 Nov 2025 06:22:45 GMT\r\nlast-modified: Fri, 24 Oct 2025 18:58:03 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9016,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ed829a7f13c3664a068d6a0f3622ff7c","sha1":"1b741b12b55c8625e38f8faff10e47f1ef5a7ca2","sha256":"feba0ffd50cbf6afbbf241cb45b4a79ed65fbd720f6e189735b0fe15eb1da422","sha512":"85632a531ba00d2a695e933464d14a3a93d3640dea9e878210362b03f106ac82190d04637d7a2857726bb36e7caf948b1e2a862e7e3f0c49247f9fb3476f8b87","ssdeep":"192:JeSpfXfCdatlpuWjZi+Z9VQ5jbOtj+6IYiUbIbGJjxhjNS+umoJV/SKb:JeSpi03ZLQ5jKhwUbEKxTbouS","tlshash":"7412b06301381787d630ba20a7be3a476506edabe9c0d06142c337b9dedbe741649d1f","first_seen":"2025-10-16T05:46:53.102803Z","last_seen":"2025-11-12T06:10:45.815621Z","times_seen":80,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/GM-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.687Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/GM-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/png\r\ncontent-length: 23094\r\ncf-ray: 9991a89e59270731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origSize=29468, status=webp_bigger\r\naccess-control-allow-origin: *\r\netag: \"68eb7ecb-731c\"\r\nexpires: Thu, 30 Oct 2025 06:18:50 GMT\r\nlast-modified: Sun, 12 Oct 2025 10:11:23 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23094,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 600 x 300, 8-bit colormap, non-interlaced","md5":"8fbf8c4ca796821625260a37712ee866","sha1":"97cb234d58617053f88556871107ba88af18172e","sha256":"99bd64d10355b9bb938fcdefc7b9b18660d6a6541356ae73e9ed1874cf12fab7","sha512":"d4a417ae5a87232d477a1deb4fffe5fd65573f16fd3a6b0849854b775b01a6ba6902680ea29f60d3ec738b662bfb79e86c23e52d75bebcc449026f67a6573e11","ssdeep":"384:YMSxf+rZe2RV7KrGSyhDxaTT8H7bYwHZ9QylXmnZBGrph0ASzuZG+1jvQGYlG:YpfCbFK6SsDxaf8bbYAZ9NmZBmh0A97d","tlshash":"b1a2d065a86f0945e318dc3c42a131694d540bcaf72c25eff8a3e5d8fe734a84dc9938","first_seen":"2025-07-26T15:40:58.845177Z","last_seen":"2025-11-04T05:20:58.395022Z","times_seen":199,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BH.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.213Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BH.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:50 GMT\r\netag: W/\"643cf38e-197\"\r\nexpires: Thu, 06 Nov 2025 07:26:33 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a895ceb80731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":407,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4bc0dacd5d4dc23475bb441fd603bdd4","sha1":"1f1853537de8bc8c64460300f326165bea0cf6a1","sha256":"d3496113366293a82a77fb84117caf4d56dd348a5bf83ca0afb95a012073201a","sha512":"bc97bfebe8721bc0f092f7990572aec26d6b016f3898e0c60027fb19035497a05646e3908fc2a3587577f81e471b472d349782d0140183d08ebfa3d2464a7423","ssdeep":"","tlshash":"0fe02b53b354b728d632ccfcaf1df5f03452240731840d77a1400f7450dae811430589","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-17T17:37:48.381484Z","times_seen":84,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/GCSGAME_getGameMatchV2?","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.536Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/GCSGAME_getGameMatchV2? HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-app-trace-id: c9f9euz502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: GAMELO3\r\nx-elapsed-time: 1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=tL8FWAPiJNqrOjVsonAPKkR7%2FEIaoZs61OzYNhqoNScLvH4MdeONawmRzkdIIKF7Bj8tj3ADmAz8TTdI0sf9T%2FlUGeolyeD10mdl\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9991a898487556a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ca238b915bf4f6f06b0b52568a504a8c","sha1":"3cad0b9a14d384d688a38f30a7680b8969535d70","sha256":"41d208271b07d58d6af07f067fb749c58fa723b2d22de24495d5477c7366e6af","sha512":"5c70f6094ca2a044f332bb4f895f7c1db53d811e4477d1c30a4a6ac105d56f97cda14ec8b1385fc6c7025c00966a64e7235293a6059806bab4949e701ceda09b","ssdeep":"","tlshash":"8180000a208000b3c002a200a8382e003aac00ab802000a8a00c808aaf20802288388b","first_seen":"2023-06-27T02:10:16Z","last_seen":"2026-05-31T03:54:46.635948Z","times_seen":1328,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/VA-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.536Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/VA-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9356\r\ncf-ray: 9991a89dd8710731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9756\r\ncontent-disposition: inline; filename=\"VA-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbd5f8-261c\"\r\nexpires: Wed, 05 Nov 2025 18:15:55 GMT\r\nlast-modified: Fri, 24 Oct 2025 19:39:36 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9356,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2bfb4b0f7abf6c48d932dc87b67b7e6c","sha1":"e8f88bf05ca364659f235d458ca08d353510f177","sha256":"d799fa3bfb86bbdd2a861e240cc2add5cedff3a2a21cc643e03f81a4619904a0","sha512":"c359510d89ed6f46285f6aa2eff0c2e82cd30aa98b33ae58d62787a55114648e7d566723dd371ffe249614dc392b6eb460234d968d68bcbd8c6a97b2b5e65668","ssdeep":"192:WbVAdD7WfP4nv8C3q6udfDaU0ZXJtL6A5nzYLiKXWUhBcx:/D7WH40gukU0JV6MnSXDcx","tlshash":"bc12bf129bb9d6732db7f059133f1ef8014b171ba7d1b61afe7a0e1b94252b03217285","first_seen":"2025-10-17T01:15:14.97047Z","last_seen":"2025-11-12T06:10:45.881877Z","times_seen":62,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/EZG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.639Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/EZG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 13180\r\ncf-ray: 9991a89e28ed0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=15248\r\ncontent-disposition: inline; filename=\"EZG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fce033-3b90\"\r\nexpires: Wed, 05 Nov 2025 17:56:03 GMT\r\nlast-modified: Sat, 25 Oct 2025 14:35:31 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13180,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c2a5d2f59d10a63233736abc10d8139f","sha1":"8512a197044c0aa27c761a8f293c49a1cf8d1953","sha256":"5f066a7eea8d3b939f0cc422d14022c041dda3fa60df8455a340b89762708c7a","sha512":"579b6c70ce138f04ae8870b89cd4a55eb136333e81b7a56cd72c830f0f5a0fff9b94dbbe9eee9ff363a63eba89bedcd90d06b5fc3554e1fd4bc7110c62815e0b","ssdeep":"384:R5ShCa4yzRDszmlEo/QczI0hGGufHyHWH3Ad:R5ShRDEo/1I0hIyHIu","tlshash":"5542c0eb6076c7305c56f4cce7c352c60fe44b0865a8830486eb9e66de5b60e677ee14","first_seen":"2025-10-17T01:15:15.120731Z","last_seen":"2025-11-19T04:37:15.64665Z","times_seen":77,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/PS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/PS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2610\r\ncf-ray: 9991a89e69400731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=3119\r\ncontent-disposition: inline; filename=\"PS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb546a-c2f\"\r\nexpires: Wed, 05 Nov 2025 02:50:55 GMT\r\nlast-modified: Fri, 24 Oct 2025 10:26:50 GMT\r\ncf-cache-status: HIT\r\nage: 388555\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2610,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0801ce49ff48217ed4efe8cb2bd22fe7","sha1":"006f81b59653c270a98fbee09b1bcd371e4e35f1","sha256":"91c4050a6b4a1ec38f4538656fbd01f6aeed916837d724d6aebe8f222d69912a","sha512":"b4b536ffed1bbd6ca7abc939f15f2f8a4d1097d37124e176d91377e5b95bb4377474ea619d1133ce393699779624210568b4cf0d3dfababb897ae8c361f9d2c9","ssdeep":"","tlshash":"22514c1b3463c737ce15e2b4967cc23d3085eecc90869054505ea7edada4049c1755ac","first_seen":"2025-10-17T01:57:49.998205Z","last_seen":"2025-11-12T04:24:41.648353Z","times_seen":75,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/WOW-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.778Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/WOW-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 52766\r\ncf-ray: 9991a89ed9f00731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=57227\r\ncontent-disposition: inline; filename=\"WOW-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68ffcf7b-df8b\"\r\nexpires: Wed, 05 Nov 2025 19:02:24 GMT\r\nlast-modified: Mon, 27 Oct 2025 20:00:59 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":52766,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0e1f2f36d86c199173f5dbda6042261c","sha1":"af8cdc021577c3512a049e59ae98c05568ea7f4f","sha256":"e85ae374ef1b496b58a747161429189f0a91d2599235246900ee8c29fb57a74c","sha512":"1535e26dcbc0c01ba66422edfba30bafb1fe62d8b81ac780feba307f568edfa59765b1e68131b6ed020a8fba75c06a2c362b3d49965d4a76f6e14bd47692bdae","ssdeep":"768:YXukynUmJg92pHIL5h5AUQjaDMfUqFCO05xhKSHyy0+Jr5x/nMYZgFD8bcmsW3Zt:O1ynnuUpOznWfYKSH3DTn08mW3ZTtZbx","tlshash":"4b33f2cb917b5dd47702f9be773416064b020c7ba70a8573284b1b067aba0af0a5eed5","first_seen":"2025-10-17T01:57:50.124437Z","last_seen":"2025-11-29T05:51:21.553747Z","times_seen":75,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/KM-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.790Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/KM-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 12930\r\ncf-ray: 9991a89efa2a0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=13881\r\ncontent-disposition: inline; filename=\"KM-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc39ea-3639\"\r\nexpires: Thu, 06 Nov 2025 06:22:45 GMT\r\nlast-modified: Sat, 25 Oct 2025 02:46:02 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12930,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1783c52497351954f8a60eb206b6e6ec","sha1":"b90a0041f0d7d537daee6c8e18454e5ec9d36d38","sha256":"2861df2a664ade403d6eb212954ca91ca446a4c23cda116c2dfd67890d2b3d67","sha512":"f9ad609ab6b1c6ff70ed0d32b6bc6abf8dae928c87cd8ebc0538717d0d27017b8313253eb32a5c99f5da3daaf399c2c4c3033e56f1c21d5d3a9ec0065c24e421","ssdeep":"384:C4zl9miBMie8rNiJMNU+BgUUsH2smMJob36r:C4u2e8rN97DUsH31o+r","tlshash":"5542af159dbca6213e8b6286938e2c7c1bcd1fe4969cf51e269998d2e12813a483076d","first_seen":"2025-10-16T05:46:53.217463Z","last_seen":"2025-11-19T04:37:15.569371Z","times_seen":78,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/mc-wps.95bc65b7.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.918Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/mc-wps.95bc65b7.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69044880-f061\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mdAGpNZqhOUg1FPFmY%2BPSLO1NmyPcXOofaNb%2FgLr6A2AiHEZ%2FyGWvy5Itz3RMM3jANFhDKg6o501yGEJw37BFAW2SB0UzoYKJVfA\"}]}\r\ncf-ray: 9991a8a0dc9156a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":61537,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (61537), with no line terminators","md5":"95bc65b725d2d5346826d21ab4a92246","sha1":"3e883f006d20fe20b208bed2126f765c45358bf6","sha256":"14f0c3f2db71bc07b1f912ad62fa02812baf2a74f687994e11408baa49eb6689","sha512":"ca3356d2efc759ea52c7343155257c7e4c8a85f08555bf4af9d17f46c74c30c72a81df44ec01deaa0c1a31c8d46a4897eb261f3ae7c54f70004347dea9b59756","ssdeep":"768:3Bx0qZAA+cPp2V7p1sX3iEJiSiOJipOfBi0Mu5XBe:3Bx0qZAA+cPp2Q3iEJiSiOJipOfBPu","tlshash":"4e5345c978c2a9ce7a33f53bcc5e7f152935be69842c4470415161aa2cf998c9223fed","first_seen":"2025-10-13T09:13:01.495309Z","last_seen":"2025-11-17T22:29:09.671811Z","times_seen":192,"resource_available":true,"data":null}},"time_used":561,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":561,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MO.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.062Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MO.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-4a5\"\r\nexpires: Thu, 06 Nov 2025 00:29:30 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8951dcc0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1189,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a829e8877bcb790849dd4c682fbdfd39","sha1":"e47679b355a2e060e45647df39b60aeb50928be0","sha256":"f73b2e21b339d54393d6ee6c7475df9e1244d84c6669de5e5f4723eb30a71547","sha512":"8f36df782c4d28cd709141c616e729e0bfec7a68a9d2807aa06f180934acb0bdc5b2d17a8fb7d6dca5adc8d4235897dc638eb1126731d2982891738257062b05","ssdeep":"","tlshash":"2f21f130e79a977c4f0083f0573571e0950f62ad64e1234da5bdc14833546d9638dda5","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.000312Z","times_seen":71,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/WPSCORE_getCustomerServiceScript?","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.045Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/WPSCORE_getCustomerServiceScript? HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-app-trace-id: 8bkvify502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 2\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R9W9M8CejUup43xgrRQA0pvPVz4me9JaXpUf38WJVMDH7VBjjmKxBN17tWqamOaFAt1HNeh5KzIpYLrOEOL3u4cpoDeFGzHmpPGM\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9991a88f0b2a56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":41,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ab73fe63450ca79f168a6d9079ca1ecc","sha1":"6a580baf771811e5df7e07f832b5f97bfc7132ab","sha256":"b728bddfbe9b957e2f4214585b7edb16fe3f89f8546ce4c0c136732ec953bff7","sha512":"f3f65049d53dfd5e6df68a51bce73fea5cb85b71d72b5e2f52cc40e4eca25802cea17e35d01186a38407a3b9515279510e810a49e0563a4fdf239d28228f05da","ssdeep":"","tlshash":"999004155c005173d00351051c3c5d00357c0057c000444c50cd45445dd0555745344f","first_seen":"2024-08-09T05:28:54Z","last_seen":"2026-05-31T02:25:53.058697Z","times_seen":654,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/AMBS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.594Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/AMBS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9528\r\ncf-ray: 9991a89df8c10731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=10740\r\ncontent-disposition: inline; filename=\"AMBS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbfa43-29f4\"\r\nexpires: Wed, 05 Nov 2025 11:56:48 GMT\r\nlast-modified: Fri, 24 Oct 2025 22:14:27 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9528,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a4dcae4bf903b6d2e9c40c7cbd64e4d2","sha1":"be960ad45fc4bd540fb0c68b6f2534718be0750e","sha256":"33b9ffb22af1326394a4f6834d3349ddf6b41a1f6472f88878ad5e3c11571659","sha512":"079a96599bd8fb6ba063f5c1fdbedeaac7e6b0e131b17558d63500a3467945fd1fa5c38102d487dd40faac62c9bdf87f242c714789540974e6840d1bc55767b1","ssdeep":"192:Mjdk2tf3ZXNvlykmxQxsG1NDz2ipVRiWiDhNz2a4yhMlvCN2THyXb6gEFkRy9:M6W3ZXRkot1NDz1pVRiWiDhNq1yhMlB5","tlshash":"ac12cfa983248dc5c20d77017e9c86b9b415e49d571fdfa799e7f6123df0ac08488f81","first_seen":"2025-10-17T01:15:15.000943Z","last_seen":"2025-11-12T09:10:09.399772Z","times_seen":70,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":18,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/ac-control-shanshan.7f819b61.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /ac/v.1.0.1/manifest/ac-control-shanshan.7f819b61.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 30 Oct 2025 14:59:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69037d40-dd80d\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=dqdDbk95T9s%2Fx2lT%2Fo8OIfWegiBzeLFVyNsbLZy%2BUbNzW1EGNPBOCiih%2Fspj2y0gOGWJ0qw704d4XVKctFD9H4CXxqehlRqpQQut\"}]}\r\ncf-ray: 9991a8a0ec9d56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":907277,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65522), with no line terminators","md5":"7f819b61b5d362132765bf9ce5c45ee6","sha1":"0334de6efa5c0a89b4243586c4e968731bc28b50","sha256":"eb44e88aa84aa4e15b8cafda3ed2d85f3bd5cac1e170399ca529bc21e4ede66d","sha512":"51967b579ce8f57e78f6d642872ced3da2914c3a718d72350d417d4a970269e39c1dffc25f4830e5c097f73b2e3f851ccae93a88c4ec356de9b087bf9538d10b","ssdeep":"6144:qtDthvN/EL4SfNQo0ysILiOMjJ1tA9wRh1cD/Xp8w12RAnLaqmci7F9Y3YbCqFAV:Rio0zA9wRh1o/Xp8w1DEKp","tlshash":"f3151a08b16715e222bb1172a49f670271666a7bd40a4c95f0bea9f11f7cc887373f36","first_seen":"2025-10-31T03:51:50.053031Z","last_seen":"2025-12-01T18:09:57.710205Z","times_seen":130,"resource_available":true,"data":null}},"time_used":391,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":391,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"xukqq.6789.show/register.html","fqdn":"xukqq.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-04T05:19:43.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /register.html HTTP/1.1\r\nHost: xukqq.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:44 GMT\r\ncontent-type: text/html\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:16 GMT\r\nvary: Accept-Encoding\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=EBMf15LPvJOq8gVAYQ45c7Lv1wzvs3TTsmzrujFhSWfoI5oXteKqgA%2B1MPE3SLAuK67mSE6B8hxrDtxvWIyvCprAJIdNo505c1YjJ5o%3D\"}]}\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\ncontent-encoding: br\r\ncf-ray: 9991a87c6b1f56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2043,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"7a5d0c071953af5f77ba05b216b8355e","sha1":"9afb529015274a7b90aba6193c23c310e455ec50","sha256":"9f2339679984fa38bcd364720624362a2ac049b65e2318097fde2cd56f4d72e9","sha512":"44d47e463d0438dac9ca8625b5ae8c4468203ee10cfbe9390034b928aff58c07cbd3235bcc0babaf6e36b767693b5a23844fe724aebfb7b4989fe7e9db0314c6","ssdeep":"","tlshash":"b941339dcee75680343aa010aeeff1485aa392db1429c8497d1da1005f1824ac5abafa","first_seen":"2025-10-21T06:00:22.068154Z","last_seen":"2025-11-04T05:20:58.401652Z","times_seen":5,"resource_available":false,"data":null}},"time_used":582,"timings":{"blocked":85,"dns":63,"connect":2,"send":0,"wait":412,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/PE.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/PE.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-134\"\r\nexpires: Thu, 06 Nov 2025 07:26:33 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8955e230731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":308,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c96225a37b5c24767640100c52467d5d","sha1":"6379e7098b91bd08452d2918a21cc3453dbc9948","sha256":"8482ba49e818304b4ed0f918d389257d1b646d24717236a5ee3d493d88907817","sha512":"2489713065b44084da44582346157c070564d508131d379c469bea3fb3e1fcf5fb6f8ab7d07f174ecd184ce967a866041e7dc1cf7b26f0a5b533c4c3a9576895","ssdeep":"","tlshash":"a7e07d53e09cb60cbf050a742b4eb1c305a7234c52c70259f4800901d10f68639423ac","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-28T05:12:57.225095Z","times_seen":103,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/v.1.0.1/manifest/lib.core.min.8b3c5040.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.682Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/v.1.0.1/manifest/lib.core.min.8b3c5040.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Wed, 29 Oct 2025 03:03:09 GMT\r\nvary: Accept-Encoding\r\netag: W/\"690183ed-a0126\"\r\nexpires: Tue, 04 Nov 2025 06:31:20 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=LVKb7%2Frpeta4%2Bu1yuJUKw1Va0hOUDZosnlQOYm5RPwREsN0W%2B%2FpHoqEy7NAXeD5dZnxsFqKu47U5b%2B02vvcbjnLfrr87GSoVKQd7\"}]}\r\ncf-ray: 9991a899493a56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":655654,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (58057)","md5":"8860972a8adab511e18c9fd0cd93e19e","sha1":"1c982c1c5fe92339b744aeffb5235e3ba5eebbfc","sha256":"412fad85e2afeaba5313998cf5b3407ea988fb9d66dc2d3cd6fbfb4b9b5c3247","sha512":"3c7c5f0d0ec3ff3c7675e6d77fca3d46055b7cb85b7715ba0795f92ef5fa7f1ad1461cd8986a0a91a949bc39acece99865f7717f7a7f61749cce013facc842f7","ssdeep":"6144:v/TERPtO7hrpJyfa0pwgrzOuL7c5aCm728p5/ybf7eu+VTm7ETiwf5Gu+:vLstO7dpku8728p5a77WLT16","tlshash":"74d43a8db201746242eb62b5003f1a0ba237552aa40a849cf57ccdde6e7cd4d61bbf7d","first_seen":"2025-10-29T11:08:15.642559Z","last_seen":"2025-12-03T04:30:52.792265Z","times_seen":155,"resource_available":true,"data":null}},"time_used":46,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/POLY-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.400Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/POLY-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9766\r\ncf-ray: 9991a89d0f680731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=10860\r\ncontent-disposition: inline; filename=\"POLY-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbf662-2a6c\"\r\nexpires: Wed, 05 Nov 2025 23:17:00 GMT\r\nlast-modified: Fri, 24 Oct 2025 21:57:54 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9766,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"96f64b577c0ca64be5166c686d09a874","sha1":"2bdc2ec6261cb14fbce2df4c64a17a8d4db23032","sha256":"91768a5ca87f46c2caf7847cc585e5bd9d0f05e64fd9435aedfb39da6c5f7eb3","sha512":"2c4fa21a1981e950f2bc95c7d3a79d7de42f2c656e80acc4de51f1ac71c1a067c8b95acfdd877ce42a5c9a2597ea2b1b16d7b06bd35bedffc868b7da403efc31","ssdeep":"192:KMW341SIODPlvrNpwD6H5IUJfFY2XWYS4NN/OUmXhrXX:1ccHcPlvhp5IUJ1X9NfmXlX","tlshash":"2d12af9a6930811d0149e79ed865a0b51e7ab7c903c4f8f56572c7908b160b04d22bff","first_seen":"2025-10-27T02:34:08.515579Z","last_seen":"2025-11-12T09:10:09.1674Z","times_seen":34,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/JDB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.534Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/JDB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6416\r\ncf-ray: 9991a89dc86b0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=7737\r\ncontent-disposition: inline; filename=\"JDB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68ea7876-1e39\"\r\nexpires: Fri, 31 Oct 2025 06:49:21 GMT\r\nlast-modified: Sat, 11 Oct 2025 15:32:06 GMT\r\ncf-cache-status: HIT\r\nage: 421443\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6416,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8f0cc4457491d7a5448770fcbb0401be","sha1":"6be954e40801cc09bb454d603689d3bc356c47ee","sha256":"084b4a0ccc19ed843c66704c4e9c77aa84ef1697dbf8d14ecc805301856be0d8","sha512":"b41092b3505771bd14dd335249568da19b2797dfc845bb3b2135604e20a9671351978b3e9d633f5989dababc9920c937c1b43d5b48d17c1702f0d6a1bb25c807","ssdeep":"192:ZgZGv4CqIR5jY5AiczVFo6WWpnrH8YLTH:Zsknn5TFo6WM8YfH","tlshash":"7cd1af8ef1bd8c20713a4c06f817eb137bd78ad1e0f6510a234637f895614c68a78eb1","first_seen":"2025-10-16T05:46:53.988915Z","last_seen":"2026-03-01T18:07:23.275847Z","times_seen":152,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/FP-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.630Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/FP-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8980\r\ncf-ray: 9991a89e18e50731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=10008\r\ncontent-disposition: inline; filename=\"FP-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbbf4c-2718\"\r\nexpires: Wed, 05 Nov 2025 18:41:28 GMT\r\nlast-modified: Fri, 24 Oct 2025 18:02:52 GMT\r\ncf-cache-status: HIT\r\nage: 382088\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8980,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ca63bdfd3e746df1da8ced32a21c5b74","sha1":"6874c29625e0e598d2e4b7c0e79355bc89ff9078","sha256":"bd47202a69e8299834624636e3b73774cb8d6b51f9b592ac11b9b3d9c0c0fb3e","sha512":"8046dd06d157c17c3c3e479dcc8a0745f4040b22dd2dcd36931825c564ca12c4cc337350ccb05088bc83dceaf8faa52753920bdd47e5c361d06ffc5f8fcb8f52","ssdeep":"192:4aHrdw7sVx8bPxrVhD6lm80avosDacmr74bGgMhvNUreqc1Jjoni:pryGQhVhNtQoEacmdDvUiB1Jb","tlshash":"4802b09065925c6758c98017f311f3d17f3eae38b2d3bc9968c9e9642011b943ed3992","first_seen":"2025-10-16T05:46:53.328416Z","last_seen":"2025-11-12T02:57:37.00781Z","times_seen":59,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/ac-ui-shanshan.4fd61a57.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.943Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /ac/v.1.0.1/manifest/ac-ui-shanshan.4fd61a57.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 30 Oct 2025 14:59:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69037d40-6a8ff\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=d1cXz8beWEqxc9RRldBDRWmWw0OkGghkuCWD2CZWjzx2O9hKkmKpvQP0JKZm%2BU4j%2BsGIdVN6bt7YyIGcOoqyEYqMO9NnMK1uRXxd\"}]}\r\ncf-ray: 9991a8a0ec9e56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":436479,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"1da33a96e9761bbfb926c723229b5926","sha1":"746a0bcc7b5072738ce22a11b7033d7b9fa8da00","sha256":"f2ce6a063526275629adcc9b092d2a945ed92477b03093bf7cdeaa5da5a54826","sha512":"35b2ccaa82820ed5f9828de80fd67552315731c62b9b605b3ef9e0578c75caba4520d2c2418809a1c2c328783f011248fd6a77263d69b2dd2cd20b9f1bb175fa","ssdeep":"3072:vjh1RDXBzXrEd+y/cBDiWiiTn6AXvcyt8nmwsTbNi5bSSSSSa5Sbi:rh1RDXBzXr25Sbi","tlshash":"9d946f14b6e70d7254b7d0d99bae2d147a20c337900ace1e3a8c9bd58fc9c29a5f4739","first_seen":"2023-04-19T14:52:23Z","last_seen":"2026-05-31T04:40:23.164919Z","times_seen":2210,"resource_available":true,"data":null}},"time_used":567,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":567,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@antv/g2@4.2.3/dist/g2.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/@antv/g2@4.2.3/dist/g2.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 214841\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 4.2.3\r\nx-jsd-version-type: version\r\netag: W/\"d82c5-eSJeFdMsBDXE0ShH9a6Jvs4xKt0\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\nage: 1108054\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\nx-served-by: cache-fra-eddf8230136-FRA, cache-hel1410030-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":885445,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (35280)","md5":"38ac8e4d3bdf9e4d4590f90f572b57ea","sha1":"79225e15d32c0435c4d12847f5ae89bece312add","sha256":"2cea25f3456374b0b3c31f35c6d9b78e638bc26710e8373d9a383ce703c88d4e","sha512":"dcbcdba45f623d55bc6dbb213b120645598396ffb7da40672d32ebed498b6b16788d2e999783e8b27e76c59d18b39ed5d3f4c69fb312b68ae54e4ab48ef10211","ssdeep":"12288:mLSlPBQyGSFzPOMKwnYgNsJsD7AzcFe4zqWf:m2a3IFfX","tlshash":"d215d9a8719078b1829361e8043f050af23ba86d604f65e9f7a5d9f3ac7d84f1076f76","first_seen":"2023-03-07T12:04:53Z","last_seen":"2026-05-31T04:40:23.098385Z","times_seen":2240,"resource_available":true,"data":null}},"time_used":38,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":24,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/form-bg-2.25b8cee8.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/form-bg-2.25b8cee8.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/png\r\ncontent-length: 250794\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\netag: \"68f70d0d-3d3aa\"\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:48 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0dm8q9WtKVlKDt%2FP5eQFbr9y7UL7h0Ve3zx77fadoff3Bnx25HiYJ20ZCCOpyxj0ego%2B2tyMnLh8y4oINKN6DieTKKyaC9MnbT%2BS\"}]}\r\ncf-ray: 9991a893ad6e56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":250794,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1320 x 1581, 8-bit colormap, non-interlaced","md5":"e855262bb3097a5e111e91a7990c7e12","sha1":"ee7990cf6d79eee0babece9834b0d818bc092421","sha256":"a79b210874049c768c63765d87de022de37de80b9cf8f6f349f083853c7062a6","sha512":"cfb3633424cfb0378bc5437ef72d4a5b9b9d49c2c5d3ee5c66165f65b3ee763cd5925e94256c1456287e5e7f2ca57eb118b88eea700b924605ed3c372de83cbf","ssdeep":"6144:XrkjS6OvJgHdAUK5nqjw03WLezbxXo+iqB14Jub2v:XUS6tAUK5nqb3WLOxY+iqBYubg","tlshash":"093423af3a1242e0a85a493c25b85d310fc1dbf7f19532d38cfd281d5ab98db1ea5126","first_seen":"2025-06-30T08:13:24.160779Z","last_seen":"2026-05-03T23:12:20.77405Z","times_seen":54,"resource_available":false,"data":null}},"time_used":1621,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":567,"receive":1054,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CD.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.404Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CD.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-1f1\"\r\nexpires: Thu, 30 Oct 2025 08:57:03 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896c8190731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":497,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ad03efd05727acf3f5ea5b0b59266454","sha1":"6d29755a7a56451df0b6955842bb650f23f6a127","sha256":"34588e3aeba28aef866421df625349791eaef361e5b39d9274b56b0a58163517","sha512":"35a52b1917727cc74690c155280fa4159a22ab962723576321d1c6b1728b7ae9efc8f531dcd676126a10be197fb6edfcd0079ed1af9d5117a057878107e25f51","ssdeep":"","tlshash":"70f09e72d1ec318c9d0447b49fadb1f21599300f514402ddb0803a16224d3dff74b6d8","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.006604Z","times_seen":70,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MG.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.433Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MG.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-15e\"\r\nexpires: Thu, 06 Nov 2025 07:26:37 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896e84b0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":350,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8785f8d07da272f1fec074ac178ace2f","sha1":"703a1fd7f634ca35cdadf79db4296fc4f349846d","sha256":"4cfd60fe92e4838ad891bc52fb0c8961f1653e77892d2243aef93a2f872b0520","sha512":"a57b213f43548bdab6c078c384e0f34fc45f80e83503ba35e6f1eba30f46484d6c1e68ba463c8b63d77d93bb49ef3253539d9b9146e190dd3f0273f62a4eb318","ssdeep":"","tlshash":"47e026f0e5b8760c9f0503646e6eb5c748e3328c7ac80baef9800960650e3df2d4675c","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.228089Z","times_seen":75,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/jquery/3.7.0/jquery.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.600Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 17 Sep 2025 19:09:23 GMT","end":"Tue, 16 Dec 2025 20:08:48 GMT"},"fingerprint":{"sha1":"E5:FA:6E:21:DA:AB:92:8F:E0:CB:31:C2:87:D4:E2:CE:9F:23:BF:C1","sha256":"E8:C7:D4:A8:29:E6:45:C0:C5:E3:AD:6A:90:36:30:4A:D7:2E:7C:F7:8F:57:44:E8:3B:2D:AF:F6:80:F7:4B:46"}}},"request":{"raw":"GET /ajax/libs/jquery/3.7.0/jquery.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.6789.show\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 27437\r\ncf-ray: 9991a898ddde712b-OSL\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30672000\r\ncontent-encoding: br\r\netag: \"659afac8-6b2d\"\r\nlast-modified: Sun, 07 Jan 2024 20:26:00 GMT\r\ncf-cdnjs-via: cfworker/kv\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\nvary: Accept-Encoding\r\ncf-cache-status: HIT\r\nage: 949807\r\nexpires: Sun, 25 Oct 2026 05:19:48 GMT\r\naccept-ranges: bytes\r\nreport-to: {\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=uRX8xa758FAlbRguaDtPuSCR5a4H9TpVF%2Fzp7EXn33j59V%2B8LkHpMrv91VF5jn8z%2Bj1LbG7CcRIRpBmKSq99iAzQ6ww8SdDJAuc5trIJDPMVp2WdxOhDCH4QbjUTdMxPBZ%2Frt3%2Fk\"}],\"group\":\"cf-nel\",\"max_age\":604800}\r\nnel: {\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}\r\nstrict-transport-security: max-age=15780000\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":87462,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65447)","md5":"e6c2415c0ace414e5153670314ce99a9","sha1":"5a9eeac34d86e92e5660e0f4f87204f1ed0c8ff6","sha256":"d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8","sha512":"de027062931edd07b01842eff24fc15fdbdcaa1af245dcd133155faba9e0c965f0a34dc6144ce3b149bc43b4597073c792cb6dabbfc6168c63095523923bcf77","ssdeep":"1536:/KRUXRa8Dgwxcy2jpBNwch96SLk8Ek2BSrBGS1ia/eEk4aV2EXi8SMpQ47GKV:/u1zNwcv9qBy1HOg8SMpQ47GKV","tlshash":"9f83f8df77ca702247ab30b9006f550bf276199d684d4400f259d8e9bc78a4a823bf7e","first_seen":"2023-05-12T23:07:48Z","last_seen":"2026-05-31T05:23:14.007082Z","times_seen":28371,"resource_available":true,"data":null}},"time_used":49,"timings":{"blocked":16,"dns":1,"connect":1,"send":0,"wait":14,"receive":1,"ssl":14},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/lotto/lott-common/lott-js.js?_=1762233588677","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.901Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /lotto/lott-common/lott-js.js?_=1762233588677 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Requested-With: XMLHttpRequest\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Wed, 08 Oct 2025 08:43:38 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:49 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=a5kI7UNpO86k6IryvRCSWRJMU6d870pjRj8DgGTB1YTTziT2zAL65mHKTCzEHvqUWYqC%2Fahp74I7VhvX1cK1dZtTBAVjHr%2F5m7g9\"}]}\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\netag: W/\"68e6243a-23e\"\r\ncontent-encoding: br\r\ncf-ray: 9991a89a9a1656a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":574,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (574), with no line terminators","md5":"67894759f2a29858696ded34d7a5ad27","sha1":"9c0f3cce7ca31ce67b82681436d8895773874043","sha256":"40dee8e22e3e97e34e2e5cd2168db23870158cc6bc0063d08addda505878ceb5","sha512":"6cbd484269126295fea2946bb5f110ca0f62de0bbdda8992557ac5fc5678ae179bc812d617e0302a06ba37aabeccd01886104ad300010d9841de1711781e84ef","ssdeep":"","tlshash":"2ff0f6282ea0f936805f2c57777ee24872a2151a9011e00468cfec1c6577fdf8eb5a94","first_seen":"2025-10-17T01:15:15.112362Z","last_seen":"2025-12-22T07:27:15.784351Z","times_seen":497,"resource_available":true,"data":null}},"time_used":558,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":558,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/RCB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.450Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/RCB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 20900\r\ncf-ray: 9991a89d4fc10731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=23817\r\ncontent-disposition: inline; filename=\"RCB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd9bb7-5d09\"\r\nexpires: Tue, 04 Nov 2025 02:59:07 GMT\r\nlast-modified: Sun, 26 Oct 2025 03:55:35 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20900,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"17cd861ea4c55425ac0091da77079fcb","sha1":"cc9cf50ddb10489fae55b3aec3092854609de8c2","sha256":"204b02d9ce68a5793021a1f994866f4ad1cdbbb77fafdba8db52342ee5ab37b3","sha512":"7caf3fec7ba38cfcd234e178cb0096b297e4dcd17b692f88277645becb0e9c0594240c14bcbcd9f3bf1a4ae034ba0c2d9e1674d44d96ce5660dff1c6b0c2f3dd","ssdeep":"384:YbQUEdLhJ6AVaCMxQm2VYv56wMtk7O0Ic9a6F+owT3fhRhMNvbBoM:86J7rA72o5689rxoomyvbBoM","tlshash":"5292d18ad5d0a4b49ebef424f863e7256752c0061444978abe10bc11cad7e7f6b81bb3","first_seen":"2025-10-17T01:57:49.689987Z","last_seen":"2025-11-19T04:37:15.599458Z","times_seen":56,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/lotto/lott-common/lottTranslator.c6284a7d.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /lotto/lott-common/lottTranslator.c6284a7d.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Wed, 08 Oct 2025 08:43:38 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68e6243a-128656\"\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=sQZUvCEo2obBqR5eqoZt%2FFc4kyEPB1UUKB4EIqvH2y1sFEjY%2FwTbx4K9HpFdwUdQjx0b8IiHgF2lhBqTKz3PmoTmTQMnpdK1OWFr\"}]}\r\ncf-ray: 9991a8a0fca456a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1214038,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (53780), with NEL line terminators","md5":"41caea5cc444f5134f3243f379b20a43","sha1":"bff4862e9e3322da162a1f27ce4e712158a4cf92","sha256":"8795f8e36b6ba4185cbe81d55d9a7adf89861b64eebb1edd4f798ec20141d13c","sha512":"5b5df88c57e0ec6502ae886cdc17164cdd74fb4e45b5dfb4436a7504be90b36ff9f306f984888bf163239bd48ccf52809052ae6376d11e7ff9130ea7cba80a8b","ssdeep":"24576:FVafx9PYU7g/Y8P6JG5r9PQfPQEn+B/krH:WL7a96JGBkH","tlshash":"4a553c7ec36767ec4eda72560d9b72a5163c01c8dcf832cbcbac599823c8e1d6025967","first_seen":"2025-11-04T05:20:58.40897Z","last_seen":"2025-11-04T05:20:58.40897Z","times_seen":1,"resource_available":false,"data":null}},"time_used":584,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":584,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/GA-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.453Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/GA-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7862\r\ncf-ray: 9991a89d4fcc0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9038\r\ncontent-disposition: inline; filename=\"GA-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd9628-234e\"\r\nexpires: Wed, 05 Nov 2025 09:09:32 GMT\r\nlast-modified: Sun, 26 Oct 2025 03:31:52 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7862,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5fe6ec7e69536d0b8540b121721cbda3","sha1":"38085170772eab2b64ee37ae8d1aa9db9ce3b559","sha256":"3513378488f93388be82daff5b2035a682ff29beffc964d4ac6fe59750fdf58f","sha512":"61521a1a507cb5de455557cc0a5ab2ad1a247729d0c3f3f2fa5ab117ffa95d22f9b7209763070743c5652c73f3cd5e78e79b87e08b88649efc5dd0e5e308d2ec","ssdeep":"96:bXoqi0Mr3WYjpgElwYmIbDUs2nf+uMTGNbFYIKSMPDhaBj4KBrdJN9Wljh1Fg6r+:kI43g0NKmLObFYIKSMoh4KLJbo41A0h","tlshash":"c7f1bf562ae383e96890a40507cadd502dd1dad09638d25fe0ded4fb38f5db8b088f27","first_seen":"2025-10-16T05:46:52.805965Z","last_seen":"2025-11-12T02:57:36.900015Z","times_seen":18,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/ES-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/ES-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5990\r\ncf-ray: 9991a89e59350731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=6767\r\ncontent-disposition: inline; filename=\"ES-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb9067-1a6f\"\r\nexpires: Wed, 05 Nov 2025 19:41:22 GMT\r\nlast-modified: Fri, 24 Oct 2025 14:42:47 GMT\r\ncf-cache-status: HIT\r\nage: 381707\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5990,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a64b27eaacc0fbe0f40c4a7958b55290","sha1":"ffa68d9eee38e324429d3ba8d68fb02e0b4d7274","sha256":"5220cd88ba0da7894cbfe663328c97aeaf979a8064d538dd1aeb77f2b61eada8","sha512":"0ce70125b6b3af73fd548dceae7fd2d1dd2171227917a1ab9516423a2b0272d439d5249b762baa3f39353643e4a84c5073a5b123eea201c2a94e6426a0d0e4f2","ssdeep":"96:PzFGSjjuMdfbsTZGdqygH3kIf/n3uLl2V8SZse33CFP8hg+2V8xwywF3huTseGcD:ZGoTZEaqy0Fnql2V8SSrWgteAF3sNE65","tlshash":"c1c19fbbc43ba478a7074f898537656a8fef24374555d93834f2cc1c5830448c51f52e","first_seen":"2025-10-17T01:57:50.016715Z","last_seen":"2025-11-12T04:24:41.513823Z","times_seen":55,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/assets/chunk/CASH_VOUCHER.Cn0Y36G3.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.007Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/promo-ui/assets/chunk/CASH_VOUCHER.Cn0Y36G3.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/common/promo-ui/assets/entry/main.Bgvu34dG.js\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 03 Nov 2025 07:10:43 GMT\r\nvary: accept-encoding\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nSgx6m8%2BuMxXPWmJz0bisQKbE92TbBz0hbsJ3qZb5fyYkB%2FCIKiJNwciwIfUPCnOfKuXJ6yPchjvHFiba2B0fik9Z1Dem6Xld4Zw\"}]}\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\netag: W/\"69085573-63\"\r\ncontent-encoding: br\r\ncf-ray: 9991a8a18cdf56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":99,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"9e7feb8066f3d589458b5e905a356638","sha1":"af4ef890c2778b4930f769e48b8ef62e4ad22b5a","sha256":"1954786bf71459c5b7b08104275b89aba32f836971d3608ba243cfa75fea9fbd","sha512":"069db298dcd6629c546d8073c5e55f9fba28963c6c888ccdbd5c40268d2b5a8a907d801d37c736570fa584973eb01ef87674ea7def6ce24433edcd575cd71ee9","ssdeep":"","tlshash":"e3b0120154a4c216500eb30d5168d15e3e12af18bd2910e8804c950273d790584105b0","first_seen":"2024-07-11T14:40:28Z","last_seen":"2026-05-31T04:40:23.139249Z","times_seen":2110,"resource_available":true,"data":null}},"time_used":370,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":370,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/IR.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.252Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/IR.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-338\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8961f000731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":824,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9219b4a55203ac0d093b4af13728e384","sha1":"ebd8f0f1ab1cd1acb25bc9e1eba0ac52a71ecded","sha256":"232c14645189cea4994735ea1e0f1fecd7ecda702986542086e935e765da979e","sha512":"68a0e0c307ddc2685c3b86ea9fdf72cfb1390de018f9822e5a51649dd4615792e6bb6f51ed9e37985b79d7d38762332abbc62dcbf58152d05fb80d84ce76b6b4","ssdeep":"","tlshash":"80014478ca61166c4d96ca64a73da8e014676386fcc423b7e82839909808fdd295fbcc","first_seen":"2024-08-19T13:52:03.364902Z","last_seen":"2026-05-10T19:00:06.518862Z","times_seen":100,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/LY.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.360Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/LY.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-219\"\r\nexpires: Thu, 06 Nov 2025 07:26:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8969fd80731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":537,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"df3155b98edf6e141f67663c2ffaf352","sha1":"5f3a045e9a68939221fd934782eb662a5347e9bc","sha256":"9fe977b421f5a9eb726e3cf5da4336b5252f6125f817d7ee1e054db4f131feec","sha512":"d31b82ae5d2170c07db3d3b7d05d2328ea7fb1ed21f04ba6094eef1fa10a1d1694a41eed8f737194ae2945106339300f9f0f2d933d6e6e7834e410507bed786c","ssdeep":"","tlshash":"72f08b55d17cb21d6920c7e84abeb0a509a611ce21aa03adf8541531710efefa572e88","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-10T19:00:06.411132Z","times_seen":68,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/drop-cockfight-img.dbb7869d.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.438Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/drop-cockfight-img.dbb7869d.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/png\r\ncontent-length: 58969\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\netag: \"68f70d0d-e659\"\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:49 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=195Z7X46XRv7DTMsX%2FEbb3b3drXE8YKiEsEBmxRPzo7h0J9H%2Fi%2BiqPWmRi0ZJse8P2I9L%2Bm7bEMV8nZPkRBjRYt3mDbCzOlZUZr2\"}]}\r\ncf-ray: 9991a89d3b3d56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58969,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 431 x 442, 8-bit colormap, non-interlaced","md5":"4caf6c0e3d0b087b1cc14ce5d1a3b16a","sha1":"288a02353a877f1519d41e143cd1a6595934d229","sha256":"fa31042369b33346078b9166f190561a8d1bb129224e6089825c9ab49f760af9","sha512":"9bb091bedaf34a0746ffb84bd2978bbbd267d064d71b9a432b0eeca3395a527501b8ca8145bc250b6ab713e436ed11e5a4a6666a6b63fc14fe371fc6bfbd9c2b","ssdeep":"1536:VWBUiH41SfbKaynKBng6XVj439JJxULukrXIO:VWJH4MpBngoV+eXIO","tlshash":"014301922205d71cf7186276d0bb5bf88906d5cbe52c000f6e4eb7a83cbe654e921ed2","first_seen":"2025-08-18T15:26:48.879966Z","last_seen":"2025-12-15T03:55:58.609769Z","times_seen":67,"resource_available":false,"data":null}},"time_used":1146,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":562,"receive":584,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/MNC-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.602Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/MNC-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10746\r\ncf-ray: 9991a89df8cb0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=11711\r\ncontent-disposition: inline; filename=\"MNC-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc21c1-2dbf\"\r\nexpires: Wed, 05 Nov 2025 17:53:00 GMT\r\nlast-modified: Sat, 25 Oct 2025 01:02:57 GMT\r\ncf-cache-status: HIT\r\nage: 386045\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10746,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"89ca2db857998d17a2df15ab5c892f24","sha1":"47fb04ca8fd8462072da1875125fe4cdd12ece40","sha256":"b890bb2d01573e6f2b97e669523c206d13f38f4187feab90fd9dfaa32e1479cb","sha512":"41790e8e7a8dead6296032d309d4082bc2c81c7ed61e64e90c0c71029a53a31fb7d853788dd6b25c4b8b2bc13b342ad4e6c684f9b9483f39eab5810653a0ac69","ssdeep":"192:5dkU5f5C1136aoNMwh+sLHNzQ4GQsfyKmycqTb+8Ulz01XAGQLt+RnkfrACVZ:zkG43S+s2asfsaTpgA1AGQLt+6frLVZ","tlshash":"9222bf3bf6a271fca2a89d61189e7d194c6859d4e78d548280c2471e8edc309b2cf8fc","first_seen":"2025-10-26T04:38:29.51706Z","last_seen":"2025-11-19T04:37:15.47597Z","times_seen":55,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/MNP-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.610Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/MNP-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9540\r\ncf-ray: 9991a89e08d30731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=10417\r\ncontent-disposition: inline; filename=\"MNP-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbee51-28b1\"\r\nexpires: Thu, 06 Nov 2025 02:40:50 GMT\r\nlast-modified: Fri, 24 Oct 2025 21:23:29 GMT\r\ncf-cache-status: HIT\r\nage: 386045\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9540,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"af829a51ae4f828c9ec3b3057bcb0144","sha1":"78e4f30ca6d5f74f0d406be081968899106cca95","sha256":"af13b53ed2082eaeb462ee21375445c9cd4449f40f6f96dc7dc6dde6b6a7b5ee","sha512":"ed5aa7b7ce1281839b28be76468260f03283bc93a673d9fc2dada95bb70756cbd17e76dc4032ce32a086414ed47ce27e268ff7ee2160ad79b390e23675a02afa","ssdeep":"192:5WglG7/Z2wvDFZxhyxnXhiSYvk302B8H1j9Q70IDTBg9JVHbW:5WgQ/jvDFDhyxnXoSYvY0PVjioA29fHy","tlshash":"5012af1a65e21644e1a25d80cb619bab99231de3df30b8478e0c44c77cf039f586f8e3","first_seen":"2025-10-24T09:54:46.601985Z","last_seen":"2025-11-12T06:10:46.058953Z","times_seen":66,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/L365-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.720Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/L365-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 32726\r\ncf-ray: 9991a89e79620731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=34007\r\ncontent-disposition: inline; filename=\"L365-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fe133c-84d7\"\r\nexpires: Wed, 05 Nov 2025 19:27:01 GMT\r\nlast-modified: Sun, 26 Oct 2025 12:25:32 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":32726,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"589948a015093648621bb3076bf23360","sha1":"ae3cfc1388eed667269817c28f982dfff6c06331","sha256":"d2ae6b80a9cdb1adac08a7bed9390f2425d74328ffb3ad0860b1f34d10acf3f3","sha512":"ac163d5bdfd279f21e581de144db0c3d89d4ec1a1181645efe668c48891097057fd26234a71576891adb839e49572223e9d2e83a3af3e792e215bf38ab124a98","ssdeep":"768:eLhyehJ5xJZCKDuUDFXkQGImdVYDUEK4ZpECnGzcA9TejqFlzBGvjgG:4hzZBxDjDFUFImdV+m4cCnjyimDBoUG","tlshash":"50e2e1a014963b1b26dfe9d1c091bbb1012a2b86ab2e3fd5811bb4f7040d7967e33717","first_seen":"2025-10-17T01:57:50.209952Z","last_seen":"2025-11-20T10:07:43.626279Z","times_seen":68,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/AUX-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.732Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/AUX-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5444\r\ncf-ray: 9991a89e796f0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=6213\r\ncontent-disposition: inline; filename=\"AUX-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb84b1-1845\"\r\nexpires: Wed, 05 Nov 2025 06:00:29 GMT\r\nlast-modified: Fri, 24 Oct 2025 13:52:49 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5444,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"422ab77959d4b4aa0c79f9f348bc5bc5","sha1":"4eedefbfc92d02d33bc9b08028a7800aa309b4cf","sha256":"d0ed2600d792bfc0daca9fe72f02e476c546bbf606b315bcad99181bd047056f","sha512":"c2ea3fd3b2825728d9efc8433ff83ecf7693ae16b10b9f8d58135eabfee778cf0a63f0c656dfcdccadf7c139c582a89d493f7edc1a410c0ac058f9605d08a68e","ssdeep":"96:M+xuP6hB560TmaE4wEgaL7tQrVOYIroUdI4LzzdCgZbtpfulwmFCwNAMEZREYOm:zMeX6WhbsVmoUd3zAgZPAZFbNAbROm","tlshash":"f1b1aef5e9344f48ab1df1628fc27744ce838ae79257900123868ac5786352e727c55a","first_seen":"2025-10-13T20:51:11.804417Z","last_seen":"2025-11-12T04:24:41.638497Z","times_seen":74,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/mc-properties.2d991a82.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/mc-properties.2d991a82.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69044880-27a262\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NJgVRSZ7u0ohO8RjZNhtZl5mup2C%2Bo%2BGB%2B5s%2B33OqzKAbsUIlQLfdFrRIICinFGj0nZ9OC52V8RtoJAzeXrnBC0Ne2MWsbdYmxmg\"}]}\r\ncf-ray: 9991a8a0dc9256a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2597474,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3791), with NEL line terminators","md5":"0d454af197f7a7dda26ad825b5cd2078","sha1":"8045059c13379747bda6e49642023eb9eb90a71d","sha256":"b18f6656a0c83b97fa9e544405834ffbd0184e230555601c7cf506e76f83cb02","sha512":"490b9c63ba67961591c1b9acceac224dde51f59425fb0aa9379ff7bf99be4f83b6bde731b587ce91a95823650c86c41d679b43687d8d85ca476aaa617d9f994b","ssdeep":"12288:+6lXsPs7w0NpmKE5Sc2Tt0nk4VQe1j2gBWMCfX6hCwBCFTwbWyP8Qyam7z2JG+XD:+6lUJ0eEy","tlshash":"df6508144e5f97a1c4eeb642309a3ab080bdad23d7a5a5cecf2d0edc25c9d7d8605336","first_seen":"2025-11-04T05:20:58.420305Z","last_seen":"2025-11-04T05:20:58.420305Z","times_seen":1,"resource_available":false,"data":null}},"time_used":571,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":571,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KG.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.275Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KG.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-365\"\r\nexpires: Thu, 30 Oct 2025 07:12:27 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8962f350731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":869,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a92b7300128c8005e1109ee88f0619b8","sha1":"8ce8d226dc568dfb6c20f7cdbad5f1d296b8aa5d","sha256":"b99d0b1cfb5f037a56a026368be18e7919bc55c12898cf6aacfaed121518c0ea","sha512":"a625ec228d7526fefbd98ccde0a67b73adf8380dc1966d14c42022a5f840ef5595247926249ec4a397d4ee2418b23f2df4a3e8f0189575855f2b2b88cdb621dc","ssdeep":"","tlshash":"c6115c68d17c662cda070a680b6a60b41f9f14dc75421b39e44d5cbc755f286f0e7d89","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.015817Z","times_seen":75,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MU.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.371Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MU.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-19a\"\r\nexpires: Thu, 30 Oct 2025 07:12:28 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896afea0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":410,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e7b1ed616794d3825927189f83d19328","sha1":"02db5b089f1e1f95931a43fd54141cb632b33d75","sha256":"4371c04fd1a19c3fd91de8d55ea01d538942ad21d857a2b19e4b4550af064138","sha512":"45865b2957f45adc77fa7ced698a86662e12566694389a29bc7ce80e35d84a7a2f063781acb015e7ac8345a8c63541f26096f5f8578fa463b3deb9ed8e7db365","ssdeep":"","tlshash":"6ae02b51a1bc755c5d1203a41fadb5eb0197374d2189039ef4041524614d7cfb80568c","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-22T19:21:41.090958Z","times_seen":70,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CV.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.388Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CV.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-4dc\"\r\nexpires: Thu, 06 Nov 2025 07:26:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896b8040731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1244,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4e54347bc13d4298ba84b506b4ba8366","sha1":"3cc58b96a4b76a6297be4fa65af2502ff67b4bc7","sha256":"b79ed88538b84804309f36e67f318b8a94390f8d8a62ccd2babf6433c6f235f5","sha512":"d54132df4fe6e31facb508076a5ee86b747b10149c7b71eef6087029fc683ee10ca5a2d8cde2e1891e1a593ee52a8e7c7bee3624739855018f2b3fedd54c1f6c","ssdeep":"","tlshash":"092178e0a1d420bdba87c711c73cb0a2b19ba02ed1f9c35dd169896893577d60ce49e6","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-22T19:21:41.135779Z","times_seen":70,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MZ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.427Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MZ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-300\"\r\nexpires: Thu, 06 Nov 2025 07:26:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896e8460731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":768,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f104942234e651bf0c8ebca00ff5ae29","sha1":"b80cf1da55a07f551316b2dcce857c562a415362","sha256":"831f84a79911fd2955a62c8d606ea0cb7c2b5043ee6311833a483656659bc3bd","sha512":"7677d4f8165e68cfcaffe8afe4992bae398982144e40737d6e67fff4c4cfbf7ebda23ca797924b9c7645f2d9cfbbcc2c783d5d288fff18f49439d086e242f5c2","ssdeep":"","tlshash":"e30185a5da74bba8990087f86f4ef0d6406a21cc21d5238cf00706202158b8fba89bc9","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.081595Z","times_seen":69,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/drop-live-img.11125b96.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.140Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/drop-live-img.11125b96.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/png\r\ncontent-length: 58715\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:16 GMT\r\netag: \"68f70d0c-e55b\"\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:49 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=53GIksJw8xoDyPFIYzPhMFusuh3nY7asRiXwh2yswgZb%2FdnellgzUnjbKwhKDrOuoaYBRXpRticYuQpSTfsfIs0PkwUxu6%2FI7b24\"}]}\r\ncf-ray: 9991a89c1ac156a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58715,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 482 x 447, 8-bit colormap, non-interlaced","md5":"55ca5a20b293f1ee55ca157e41c215d1","sha1":"3f00950655b81d42efe0cbc517a5b00aab21cdf2","sha256":"b0fdee03eab6fafe1c52d18d3fab537bde6326577428d036bc254e339a0cd9e0","sha512":"d69c5adf25191ffe09391857c6f72733a3d0d80d1c8b5bbda737ddaa3535a2653d1ae92e19a747f9957d64103de5259b1f5f998f298fa08c3b61c6b00903d428","ssdeep":"768:PFuzZdP3QCEa5pH+IAkg9wmnt1sVvkU0j4lRqCUbvcJ5Dk4dB7qWF0PlqsuA6EWJ:PFm0k+z+uU9oXLEyUqWifQEWH/MK0k","tlshash":"cb430205c7d8643a15390d8303aaf8e704f679aac7081cbcbd97af6cf24ca1019d0e75","first_seen":"2025-08-18T15:26:48.931883Z","last_seen":"2025-12-15T03:55:58.540727Z","times_seen":68,"resource_available":false,"data":null}},"time_used":603,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":602,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/AG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/AG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5374\r\ncf-ray: 9991a89c2e380731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=6661\r\ncontent-disposition: inline; filename=\"AG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb8f04-1a05\"\r\nexpires: Sun, 02 Nov 2025 13:47:15 GMT\r\nlast-modified: Fri, 24 Oct 2025 14:36:52 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5374,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"daa4abf35eeaf48575a179e222c7d158","sha1":"7504b63d54007a4d1f3254bd78f2be540d7cdadb","sha256":"3e0c5856f0a0f723fef51a9644fa6ce74d2fff49e5fcd5130f189d05dc9b6abb","sha512":"a2e84c0bf25454c358e3c826d4374ab70cf2c6759d4d367a938912c549fee3c724967e06cd2aaf0a7ed90e2c1909ab9e264cef9d6197a756a7f2c3b996f74859","ssdeep":"96:mwiNDsuznfLs9q9ppuYIBTfsvooAVd6+4O4b0XwKZa3h9+dxz:mXJjznQkQbTEZAVd6+43bYZWAvz","tlshash":"aeb18e9a51e85ac48fecb43a24da92c61381982d873bc76c1d1685ef38378924986d9f","first_seen":"2025-10-16T05:46:54.076233Z","last_seen":"2025-11-12T02:57:36.880979Z","times_seen":44,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/MG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/MG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 12802\r\ncf-ray: 9991a89c5e7e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=14804\r\ncontent-disposition: inline; filename=\"MG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc9d85-39d4\"\r\nexpires: Wed, 05 Nov 2025 18:52:28 GMT\r\nlast-modified: Sat, 25 Oct 2025 09:51:01 GMT\r\ncf-cache-status: HIT\r\nage: 405130\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12802,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"85721c9999ce56e40d703e8addc35aa2","sha1":"6206d515c5f21f483dc3704d0dfe079babe15854","sha256":"4e5f6fb6f7eb2b3d957a4b7ec2c40ca86ca9846dc2df8f74e70830a3327ee226","sha512":"d2f7bb48a237ee1ed6e1106f84f32a7a4bcd22a16687a57afc72c7ee32473c278c51881308e8fe166f1a715eb79dc73b503a511327b579511af8607b1a7e6ade","ssdeep":"384:pFSVXy02jsJKpq2l/4XZC9EavHDoghQ35f6v0:bS5ytzAXU9EOls","tlshash":"b142bf076822624f5861485f878d7cdeb1f135322eb28a69cacb5b4a2f7280fb16c447","first_seen":"2025-10-16T05:46:53.113825Z","last_seen":"2025-11-19T04:37:15.620024Z","times_seen":102,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/drop-esports-img.7bf4fc58.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.471Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/drop-esports-img.7bf4fc58.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/png\r\ncontent-length: 66541\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:16 GMT\r\netag: \"68f70d0c-103ed\"\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:49 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self'; form-action 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KcoLM5%2BqNYknlZKa32ESymESzgNLQepip4TbFDbBl5LnIDH6E2LUe7PAH1PGwe1aea2MMAI%2FETmlLWlANOUGM1rEXolEjX6p81Ee\"}]}\r\ncf-ray: 9991a89d5b4c56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":66541,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 431 x 442, 8-bit colormap, non-interlaced","md5":"13fb91700a68c9ba682e9e05cabb244b","sha1":"14c803bfbd13ef3f7a18e9e50ccf98187b060519","sha256":"f73acb3079678c8e9ea74d3766761346f13148a38b78984c9d1c31e0cca91061","sha512":"304de0fe7bafb384763251679b2524b236738111b4fe569c9f8bc27cc07a6ce4156e409965902e4eaeacae4090254d0b2b8d9ae2b77e0f34f930f7638612b121","ssdeep":"1536:rHxyXOnroEN41n2zuYSQXN3G72km/VMNjLE/8jJ8fzD:rRPzudQ9Y2kSmLrK","tlshash":"f6530189201d33fafefd03f3eeec9651fb9a40e5264d6975a126c96f0c19d904207ad8","first_seen":"2025-08-18T15:26:48.734498Z","last_seen":"2025-12-15T03:55:58.601465Z","times_seen":68,"resource_available":false,"data":null}},"time_used":601,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":599,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/5G-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.644Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/5G-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5362\r\ncf-ray: 9991a89e28f50731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=6244\r\ncontent-disposition: inline; filename=\"5G-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb7a1b-1864\"\r\nexpires: Wed, 05 Nov 2025 18:52:28 GMT\r\nlast-modified: Fri, 24 Oct 2025 13:07:39 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5362,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8492d1bb43facb6a2052f3d9791dccd0","sha1":"d2bddf80f7e44eaeea5e9f91227fcd6b5634b2e2","sha256":"ee8b653c2940b4b81c41acf7377ac6349bc9548b800cad91024da8cac0ae7bf0","sha512":"c379426e88fd23e8a45b10069f2025b7d5bacb8435042ceb200df37265100ee729f2cae732a0b6917cdb8900f206ece9d47e308d9a2ca59593d337f298c4e27d","ssdeep":"96:twhLhJxQbK/LWUwYMEUIijFblbQ+TOLFJ6HLrj5C+GmOCHVMFug3bbp:OhtkbK6XYac+TO4LrtnHuFJ","tlshash":"9bb17e035fa615b9438dc4e52ca4093213c1de26b01609e92ddbba46e10edaf17fce9d","first_seen":"2025-10-17T01:57:50.199991Z","last_seen":"2025-11-12T04:24:41.477227Z","times_seen":51,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/v.1.0.1/manifest/manifest.json?_1762233587839","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.844Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/v.1.0.1/manifest/manifest.json?_1762233587839 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Wed, 29 Oct 2025 03:03:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69018401-891\"\r\nexpires: Wed, 05 Nov 2025 05:19:48 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=uhj0fx8p%2F9Wy3Ao%2BqyUABvJMAyEBEHjYSblY5ZJ3caLeUYGrnzeAkQIKlfSd6o0VK7sGtu%2BHflYsiE5vlfi%2FylPytdsoeO1Hp5gG\"}]}\r\ncf-ray: 9991a8940dbc56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2193,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5fae68ad9c3bf5f90073c67872960f1f","sha1":"73ada98c056d176748f2ce630327523091eaf03c","sha256":"e1565cd7c33b844f71bd8558cba1f9cc3ef8b0c8b47dc32e7cecdcca55226210","sha512":"69eb5ac355c42238787aad6d6693e07c44c7a8688ad00c806abe5433e4c149dafdf30537a859495acd4e30111314ab4fcfcfcbb121f5c5251bcae92b03acbbea","ssdeep":"","tlshash":"2d41261c41650f9bb4f53d58a8971e956db25c13b821b22e93171188cc3e66e50fb0bf","first_seen":"2025-10-29T11:08:15.633521Z","last_seen":"2025-12-03T04:30:52.767698Z","times_seen":160,"resource_available":false,"data":null}},"time_used":384,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":384,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/LA.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.022Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/LA.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-173\"\r\nexpires: Thu, 06 Nov 2025 10:27:22 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a894fda40731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":371,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c86fffbfeb449e1b591d859528de4129","sha1":"880b2ccc6a7c5410bad6570c34a406ddcd35ff3b","sha256":"17b180f2752f18285fe05208e23ab59e0cef661f84668661c193947c4de16e71","sha512":"e70e45f2347f1e890620aa2e6b99d6f514d38451f9bcd95dc21199089fd6b1e35aa5405e296c19d8fadf5df0b92fee2e82aa89a1cc13b6e3b67f88f2aa435628","ssdeep":"","tlshash":"b2e06f92e1e9a60caf0001a82b2ff1d215ab318c22c5039ab4000a14a80e7ef2c067fc","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.231042Z","times_seen":72,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AE.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.242Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AE.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:50 GMT\r\netag: W/\"643cf38e-194\"\r\nexpires: Wed, 05 Nov 2025 04:08:24 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8960ef00731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":404,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"dfeb0f940880884d11f30ebceef464be","sha1":"e1d432170fa5b057e32d20a3ee57463a7e5effef","sha256":"0f06b4c957bede126a408e1b94d8672a7b1084c190a9f5d41bc95252974fc246","sha512":"6ffecc117e02ea4a5efacdf07686153bb96e336fdf495b3c06e23e309f4d151474c302c2ad04c2dfdfb939a73e1623803a0b5c4426fbf76b56105ff7ddce88a6","ssdeep":"","tlshash":"eae022f1d569b30d7e484a647e9df9d688e373ac72880289f8900810a05d7dbb94675a","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-27T05:04:05.904184Z","times_seen":166,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SC.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.406Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SC.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-1e6\"\r\nexpires: Thu, 06 Nov 2025 07:26:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896c8220731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":486,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"bc08a6b5a14fc42c3b05d519ec6f810b","sha1":"3a196db2089cdb63d738701cf44571e117d7b9e0","sha256":"a5aadfb7889050763d3424fe50824e5eb303c231d2cee81e5ff948599930e7e0","sha512":"552deed64e14cee570032294c1c23a0fbbe72a8df0b7bc5c8ac9c65fad8f5162adcfc2909aed3ee3bade82cfcec942974f97b365b0d86eaef358f38342587122","ssdeep":"","tlshash":"34f05ca0e0b8b75c8e1103e42f9e74f124e63389629903ddf0801820601dbcff949ade","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-22T19:21:41.097927Z","times_seen":70,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NA.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NA.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-278\"\r\nexpires: Thu, 30 Oct 2025 07:12:30 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896e8590731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":632,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d1ebb4bd2c2097be74d64f8882d6997e","sha1":"413e9dfcfbc266e0bfd3e678a034413f2d5ffac9","sha256":"20cced1f49d36fb9a9bf28abd3fa8de2020809cde24499a37028df4f60828802","sha512":"94ad032ad7ad2751bbc09b5944d5685ca80bd6aeae696db1ffcb8ee0f554324006025ecbc601235a20ecb64fedf0f0a6b5be7d22feb85c7c222b9b1627c44454","ssdeep":"","tlshash":"7ff0ac92e0f872d85d0447f80f6eb5f21463b14ea094139dfa851541b39a3cfe06b6d8","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-22T19:21:41.107979Z","times_seen":71,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/index.js?_=1762233587030","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.905Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/index.js?_=1762233587030 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69044880-3217\"\r\nexpires: Tue, 04 Nov 2025 13:19:49 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5bXeVmamQLnRFbDD0%2FjSLhnhvmOrjg28egZEh5trikswTWpUORBUtZ%2FbP4yqoZme6ZpgJb8UTLIiZQ%2FnHUBbdiHKAL93YEDnFZle\"}]}\r\ncf-ray: 9991a89aaa1b56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12823,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12822)","md5":"1e84b2a5c1671439b2a5fb358e9fec19","sha1":"ffdf1cf1b5a60c28535c2471c50eaa17061e2230","sha256":"ed1fe02315cc904f5327b03e1c773498f76fd7afd0f5c40041d07df4a8da1002","sha512":"b3fb378d243d0c626d427a8c7295cc26488b42df3e8767e1f5c869bd03337e5823fe0a434e3c60760b00bf491d8a6ebb3a0ef831ecb1353707184a7b26948949","ssdeep":"384:ZbhJNKg5/885YHtkLhm4yNHFeEWipjrQ8WFaLjLsu5HNaFrsrwZ7BAhqZ7Wudh+O:xvCdhlljWkPjq1","tlshash":"2b428e170c0e846c168de5bd68654e4c6fef8eb25fc51e2db2ac8a7d052d80f49d93c8","first_seen":"2025-10-31T11:25:46.376002Z","last_seen":"2025-11-04T05:20:58.431442Z","times_seen":24,"resource_available":true,"data":null}},"time_used":547,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":547,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SEX-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SEX-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 20552\r\ncf-ray: 9991a89c1e250731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=22529\r\ncontent-disposition: inline; filename=\"SEX-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fdb660-5801\"\r\nexpires: Wed, 05 Nov 2025 17:57:56 GMT\r\nlast-modified: Sun, 26 Oct 2025 05:49:20 GMT\r\ncf-cache-status: HIT\r\nage: 342258\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":20552,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5b252ed7dddd30c9260e296456cef0fb","sha1":"2ea224a8832285b5197fcd6bb25352f393cfbac1","sha256":"24b1f8770b493060fc3f5fe0d9fd184607d292470f0dc03a0e415e2e60cba6d0","sha512":"5b4cc27797a0d2cdfbdbf0af03bcd0cf7e154007e7eac60670fa99ec6ff7370f7d9e9cfc7fe9c1d3c6b334ff8c3ea40ed9145fbed8b8b31545003ff824bb25ed","ssdeep":"384:aM+huipdmROVRY0Laq1mPX2vK2xEgcO6Dl0FOCwBf8IHSLhTp20ilDl5/b:XE1LkWLaOmPmSm4dDl0xajStp20ilDnb","tlshash":"f492d04fd3c804f553164e6c14fc1b8897b111d956f009e926bfff2c8659a72369ac2b","first_seen":"2025-10-17T01:57:49.712472Z","last_seen":"2025-11-20T10:07:43.596045Z","times_seen":79,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/WMT-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.651Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/WMT-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 20630\r\ncf-ray: 9991a89e39030731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=23089\r\ncontent-disposition: inline; filename=\"WMT-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd5061-5a31\"\r\nexpires: Wed, 05 Nov 2025 19:28:26 GMT\r\nlast-modified: Sat, 25 Oct 2025 22:34:09 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":20630,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"44168a22895581c08d925edfa852977e","sha1":"d5726dd2b5e4a3da3e56598c0bfc452d142d42ff","sha256":"9eb45f75252864db3b1a2636c9d5ec741c4b805546dbd9f8ecc317b66d89e649","sha512":"8535ae3d3ca6505610a4fd75a1f89eec56bba53a92518053498c3962e65894fd48be39aaefeb8f50d3732a1954e9c4ee360f2fff3897650a42782d02c6a8d903","ssdeep":"384:T4+JIyI4dSaF7qKrIEVTyZ5OjMJzLY7X54C9tJNjTWUM3Y3hHo4CdWoi7rMc6CC:c+JICSadN0E8Z58SLW60tJNHwWhHo4Ch","tlshash":"f392e139aea740cb6915c53f25138ba5a4d8dca09e7ce21342b351f57c35a5e7b320cc","first_seen":"2025-10-17T05:10:22.567378Z","last_seen":"2025-11-19T04:37:15.675844Z","times_seen":57,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ID.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.967Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ID.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-118\"\r\nexpires: Thu, 06 Nov 2025 07:26:32 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146629\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a894bd430731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":280,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"29d7dbd5af98200ee68517c4be6b94f0","sha1":"d18e1746f37b64e420dfa20e9037f5c24d0d9af8","sha256":"58a9576193e2055ecac16e2dac1c27a621b07289c4427f8aad548612e0c4ef11","sha512":"be3a382c4bf86a101006f2ca9e9612babd80f2269e43c4382a7d1acb5bbbdf92ec86c1f10b8b43c79a37f64c3f1bd1ccdb044d4201055a579b859e972f3b0286","ssdeep":"","tlshash":"5ed02b51d0baaa1cab1442a8af6ef3c205b3224c72c9035ef4401d1ca14d7cfb941b9d","first_seen":"2023-09-17T23:52:34Z","last_seen":"2026-05-22T19:21:41.079745Z","times_seen":192,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MY.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MY.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-2f4\"\r\nexpires: Thu, 30 Oct 2025 07:22:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434075\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a894bd480731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":756,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"af3c3e9b290175550cb7a19b7721ccb5","sha1":"1f6cd49803b5515d6ad484fef5a86485433dd6f3","sha256":"2936c5c23f432328f615b4ae1cb879031651f8f174434f751c9ad1e45fcd8fea","sha512":"4838dfce4272f09ba88ff0171a920d73da49f6e59ce210d8262f8613c280188ccdbc990dccd7b0478d3e2d7187f802f894a365d3d767a44106f98af781b12b98","ssdeep":"","tlshash":"c7016d51e3bdb3acad0493e49bbdb59920e312dd2169429ee4851920300a7dfac465ea","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-30T13:20:41.735336Z","times_seen":134,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NE.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.334Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NE.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-191\"\r\nexpires: Sun, 02 Nov 2025 07:41:47 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8967faa0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":401,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f1c7f30e78f7dc79467fbed3d77fd564","sha1":"b68857e32193816fe75365e67fdee04aebfe1765","sha256":"74abeb05e00eed1c1092862c5446c61ac1b8bf8274279495a2adffc0c6741725","sha512":"a21dbb4e4e7bc1ead3f6b2af7f21012889f67c0c3f0793377699690d0b272fcc1ca46c84a623c21e569f16323247f079f1a4cf3168842da74c7687bb62020c8c","ssdeep":"","tlshash":"77e0228190a9b64d9f4483ac0faf75d2045b218da2c9239df8580920710e3dba901bd9","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.214818Z","times_seen":67,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/DJ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.419Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/DJ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-1ba\"\r\nexpires: Thu, 06 Nov 2025 07:26:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896d8330731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":442,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1ae4c0f6d4facad34075252f928a0a82","sha1":"316d29122cfb8c0a13e80a309753291519e723f5","sha256":"019b6be8bdc49e80fe38ebf6f0c0bc8472ff67331fa737bd1fe2a933182fe3c0","sha512":"10af04e818e4b0ebaa47a1e517ab48cca4f4c993693cbfdf80edf6507f51767d093d7fdb1fb1f4a7fe5e36bc4489fc67c285e2ebb7c379a459d3d9fd0ff7db64","ssdeep":"","tlshash":"7bf05c60e27976989a0443b03e9ef0c34497368c31d9334db1402a202168f8f3a85bd9","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.231589Z","times_seen":69,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/EZ-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.210Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/EZ-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8848\r\ncf-ray: 9991a89c4e6d0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9797\r\ncontent-disposition: inline; filename=\"EZ-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbc7d4-2645\"\r\nexpires: Thu, 06 Nov 2025 03:21:12 GMT\r\nlast-modified: Fri, 24 Oct 2025 18:39:16 GMT\r\ncf-cache-status: HIT\r\nage: 369081\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8848,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7a8aeabf3615f03a45cbed4749a8ae71","sha1":"29aa4e71957351b128cf3fc3aa34da86383c302f","sha256":"51d4c6a997ae905be7a84d43374219139e0b9efa64850708a3476f83f6f9e386","sha512":"f8194da3c365a8507854fb08374bc23bb00edaf818cc419a68fa4e927b0ebd380a3145209177a00f16ef986e080d66c1044cc0fd0531597787b631d57a497ea8","ssdeep":"192:3YNNX8NntEgrPGw67juBPaM9JyYTYB/lpiNtAzX/vU9jH2p:yX87PrOKPJKYg/lpAAz/8sp","tlshash":"3f029e975133d0c83bbdd7e8492753b23de9c22a2378ff5e22f555561a13ea2a3a0406","first_seen":"2025-10-26T04:38:29.684435Z","last_seen":"2025-11-12T06:10:46.037494Z","times_seen":50,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/mc_icon_s.0fd68d55.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.922Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/mc_icon_s.0fd68d55.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69044880-bd5d\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WVmYvR0kw0UBw1icIGPtYyRTdbNQImEvS2E3ZjuADKJuiX4MfAy3LgEmONH5lIDd7UnDykrGLsgCtWlHEudOUzxwYBoUKdKaLQwU\"}]}\r\ncf-ray: 9991a8a0ec9756a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48477,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (19771)","md5":"0fd68d556c238d7b30cfdb73444776a4","sha1":"044896b598ab35d3dfa9b60da362259f7e32d599","sha256":"58d51b59248c18d27839d3073ffc1d6e5f5077d53edefb17bc375561ee5350d4","sha512":"4ab66990d9b20b1f5a5ff20bc02211c8c349518331ccc0ca8f409f803605701e60e6c30787fb3d96665855b0bdb344bc723b2d7600980f0aa5b35dd75768f4bd","ssdeep":"768:2AGSz4TYCGRYZazCrr5H3EcvlV4ehTP5uO8P3m7MF7MNP0w6Bfw9rnsiPuxY:2SKYCG2NUGV4eh5uOE27MZMiw6IrnsiJ","tlshash":"3d238f37890b7c902a2c2dfbcf673c5c5f69e18395934bc4e5dd4ce8a41a6261e0976c","first_seen":"2023-06-27T02:10:19Z","last_seen":"2026-05-31T04:40:23.1515Z","times_seen":2063,"resource_available":false,"data":null}},"time_used":611,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":611,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BR.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.033Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BR.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-2ae\"\r\nexpires: Thu, 06 Nov 2025 07:26:32 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8950db10731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":686,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"057f3318ec8094abfc02d746d78f167a","sha1":"e3b01f9d74eab95a00095ca02fbae9d38ac1dc52","sha256":"2333b293cbc44e8b736565ac84d4bd03cb136f017e5194d321dcc8ca46aa0464","sha512":"39cd49bc1a77e8ac77ede8ecaf47a140f0210b0c592e4242285c38a53001735d597236ef2cd98218345b0d2dc5338676a0b6a10166e0341a835c7407d6291603","ssdeep":"","tlshash":"460147a594ac238c4d1582bc2f3b60e00b4f266971c102e8a8ad8170914e2cbf7f3a58","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-31T04:40:23.217563Z","times_seen":329,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AU.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.114Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AU.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:50 GMT\r\netag: W/\"643cf38e-362\"\r\nexpires: Thu, 06 Nov 2025 07:26:33 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8953e030731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":866,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b966d328a46774f56be26905f9eb9684","sha1":"7802a407907a7dc494c4797dbb39e4dc315f318d","sha256":"2dca728e7e70fffba5efeb1d7f5230f9fad0a4851c5b4daeb187f84f775e845d","sha512":"4ea5a2fcd4694637deff469d46972b4a998bd85a510040f08dd17a932cfc084ad5cf2e1300f3afc7ccb3f7b6d5e1584840543b0239fde8f2caf6f455b07faff4","ssdeep":"","tlshash":"ab118cda60ba3101eff0528589ae7485253592ea21c64faff8f154c8030ef97d747dc0","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-27T05:04:05.959571Z","times_seen":237,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GT.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.297Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GT.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-264\"\r\nexpires: Thu, 06 Nov 2025 10:27:21 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8964f5a0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":612,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c9385b061ee36b46006e063311c0d6b8","sha1":"c094f27c8b8cd4b4a4bbf748a0fc26c6770545da","sha256":"f2458456ca25cd40534139a42baa4094c3aafad47963e1986847de3d0a7f0deb","sha512":"ae0d1128474c4763a57cd8a0bd93e431375410370902b2358cd5c4e3f93a68c94ed73f36af829a688e5435acca47ad0a0137eef1d81d0022d18a9d35787a9b1e","ssdeep":"","tlshash":"bdf078625179a31c5e028af86f7d70f2485e701e348913adec4b0a38b00d3ce3a26f68","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-20T06:46:14.001521Z","times_seen":91,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/index.js?_=1762233587036","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.039Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/promo-ui/index.js?_=1762233587036 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 03 Nov 2025 07:10:44 GMT\r\nvary: accept-encoding\r\nexpires: Tue, 04 Nov 2025 13:19:47 GMT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SZN0z3jNx5eLYQW04IoZUhM7l5RPEEw%2FB%2B%2FToBJJC10f0TUY1nZ%2B17O8jGLqZniQuag4Bx0IC9yyQ7jE13LEphzG72hK6BesQ52k\"}]}\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\netag: W/\"69085574-36b\"\r\ncontent-encoding: br\r\ncf-ray: 9991a88efb2356a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":875,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"089c104c7052a49db80451361c54d9a3","sha1":"fb51abc764ac93f47666e4063e48d01190595c24","sha256":"6520c0df388941f827d035c7feb34c23debdfa5eac20e11314cf351bca12b1b2","sha512":"736247d380b55a8ca15be3c53d430cac11baefe0bca6d497dbd9d4175a260b30d7926c82715aafb39ea312c4f725a77e29c586d7e282248413242955d0f9656c","ssdeep":"","tlshash":"ae11880e9bf380a8747b309f97ae6804729282875021d591359cd8e2ff64da402bdefc","first_seen":"2025-11-04T05:20:58.43791Z","last_seen":"2025-11-17T22:29:09.817477Z","times_seen":58,"resource_available":true,"data":null}},"time_used":593,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":593,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KE.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.292Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KE.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-431\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8964f4e0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1073,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c0bf589a9511a36bea87979ee4c1c3d1","sha1":"841561b084a6621a63db774a21e1e7810ad89aca","sha256":"a7c07574a435ae1a64fea57b0186833f3bae9a0854c3f84700e6b55bcc826f74","sha512":"381aa7c4836f1e88001bed2cb6ab69bd0f8cee34b388b6965ab2a3991b90f4d13c3bb74fcd5406683fadf964f9861401c16a07dc481f6fd51428b07d12c48618","ssdeep":"","tlshash":"b31180b882f8f62d9e1143a846bdb0de615f60edb49c03ecb4841664b21d7cfe68295c","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-23T11:12:55.969156Z","times_seen":117,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CL.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.309Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CL.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-1a9\"\r\nexpires: Sun, 09 Nov 2025 01:59:51 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8965f750731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":425,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"dfe5e4b9ad7f02d4196be54274b274c7","sha1":"c2e9554e60867bf8af32ad3365ac33a2cc250371","sha256":"adc5239ae20b01235b9a6e62947c1b21f77d33adc21dae70b8cbb23f507b7fae","sha512":"68d43d16cc71cc871167b48bd1bb2b19b23b3b1ed56f1178c6145c0ea77d50a5a12dee9196c22c7294535872dbe68d09c6f7e1ba5133b308b7d6c895df8b7952","ssdeep":"","tlshash":"7de05c6593e57a588a1043b0ab9cf1c640a7224c7189135db0400638511cbcfb9496c8","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-28T05:12:57.232522Z","times_seen":107,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TZ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.420Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TZ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-1be\"\r\nexpires: Thu, 06 Nov 2025 07:26:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896d8340731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":446,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"77bf1703cfb0a28378ff5cde4f18bed9","sha1":"03582baec5082b6dde2f65634983c27ddc0460b2","sha256":"12109cf242c6f6c910a3269122bdd01a3f64ed5008c7ed32cd2b5cbb6b18da44","sha512":"6f9c84c7c6f95b3b3d41e0a1edb07362524127b0d078cb944d4795916f46a8092555daafa3a9ed687b5f60dee228bbcae79220ea38e82c5306227323ed84e986","ssdeep":"","tlshash":"adf055d7a878aa5c9e0906706feef8c20407318d12c8069df0001821a19e3cf7acaf88","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.225527Z","times_seen":83,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/365-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.779Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/365-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 44156\r\ncf-ray: 9991a89ed9f30731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=49607\r\ncontent-disposition: inline; filename=\"365-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68ec03a0-c1c7\"\r\nexpires: Thu, 30 Oct 2025 22:04:51 GMT\r\nlast-modified: Sun, 12 Oct 2025 19:38:08 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":44156,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"96f4b98a42a1ddaf5597a722fae13066","sha1":"a5df92dc50cb859649bde6707c650ead0c6be2d7","sha256":"0362263bb418168192667bc8a2930b8b91182255cf05d002564f87ef5b8813bc","sha512":"237afb00d166dea19727d223eb0f2c306926f9be205ce43fbdacbde00224c9cf110f9604deffc03efc585508f1126b712ccf479c2836093ea885d3eab78120b9","ssdeep":"768:lfMqwRf2UN0ATtr4pJlEEZvliJd8BOp3jffLrIwEFgalOlB6n2Hmt0cAhfXO/XTk:lHwYUiATtrGEGliAE7fvJxaoe2Hk0cyd","tlshash":"0a13f1a6bfffa35242981b9484911b908cb28c230d8c7746f37748a17b6d43fd9de594","first_seen":"2025-08-01T06:09:57.24231Z","last_seen":"2025-11-04T05:20:58.440951Z","times_seen":87,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CA.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.097Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CA.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-1b6\"\r\nexpires: Tue, 04 Nov 2025 03:34:41 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8952df20731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":438,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"42c61d70587393fa5270d4addab566a6","sha1":"4eca0a10000317d58a805bc9b24ecc1e6c334a30","sha256":"be435f09cf3e411f2436202801a90d127800cc5f7b970fdd95aa4f177f8075a9","sha512":"c1920caa3ad261269c2fd2bbd809a4076b736e1af895d6f512f8df6b629babe1114e79639946162b7e3bf7db40caa1b07feb39fb87f45dbff73a07fef4071d02","ssdeep":"","tlshash":"1bf0ecd5e1fe7a08db5506e45f6e70c94c36238f06d007fd71805952654db866509bd8","first_seen":"2023-08-10T10:55:06Z","last_seen":"2026-05-27T12:17:22.44862Z","times_seen":307,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MLI.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.333Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MLI.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Wed, 27 Nov 2024 11:22:23 GMT\r\netag: W/\"674700ef-157\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8967fa10731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":343,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0fdff6d2b13f77160baccea393413240","sha1":"6a2a847257e2df17cf1cdedc52e0d109a32b1f04","sha256":"348881785db2248fcf172f4c589a6fba274136f8a42dfb0d400b05b37e20a036","sha512":"ea2050206a1bc8dcda122a5c3083a99e67dd1e67a406df4552259ed3256c6cbb41d035a515b11b23dee4c04d2c6ff8e840c6f960cca8cab33c56392d42938f59","ssdeep":"","tlshash":"79e026b6f5e8ba0cbf454b682f9db5fb05a7334c62c5039df4841901a10e3cb7a4665c","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.218535Z","times_seen":75,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MR.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.365Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MR.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-1ce\"\r\nexpires: Thu, 06 Nov 2025 07:26:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8969fdf0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":462,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c94614cf0ac44e46ee110c4f1f942f4e","sha1":"ef2899f3539176d83e47724cbc736938d2ba44d5","sha256":"3abceb143fce6c4bd40f5efafefd035585697c927757c511296dde70fde749fc","sha512":"bb095751cdf34e7ae483b5d322d27859492e7267b0090b1a6a7f74c0f7508d26164f02fa35560b22661c02a5651173dbf11ba2264e4b4a9002741259dd71c688","ssdeep":"","tlshash":"eef09e31c148640d1d1443b40e3d60da456721ae71d48369fc680a30604e2cbef73a9d","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.520012Z","times_seen":69,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/IQ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/IQ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-25e\"\r\nexpires: Thu, 06 Nov 2025 12:01:51 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a89718980731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":606,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0885ff7d2ac292fcd7cdd5dacef7f4e4","sha1":"f3603d88dfb3277806132ee37d016691b1d03c15","sha256":"b407edc660f219af29c77c72e9931edd4e18c02f0f6afdaa9d597d0f2336233c","sha512":"98ab1c77ea670c10b456d4a4365315925e31a64c12ae47e0b22710830df5241d1a642e2bfaeb1d64cce548ed6e8fc19d44c57ca250ce43087f5b281c60725ab2","ssdeep":"","tlshash":"c2f0dd7084a9228cad424a685badf494558b539c359c024db8541c16b109bcfacc65c8","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.498113Z","times_seen":57,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/WS168-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/WS168-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 26708\r\ncf-ray: 9991a89d4fbf0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=28516\r\ncontent-disposition: inline; filename=\"WS168-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fdd52e-6f64\"\r\nexpires: Thu, 06 Nov 2025 13:29:12 GMT\r\nlast-modified: Sun, 26 Oct 2025 08:00:46 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":26708,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"594e2bd518b3cff0d642ee90e09a1a93","sha1":"9da029e150b3563892c89baff63a73e6f4065dd0","sha256":"b6c0d0bda7e60064c4924fc0f49b6c4f6fa6168d950ae6733e030d2ab5f003c6","sha512":"30fc36a06eefbc4cb9a66caa89f12b2d7113132dd4102ac032bc4182be1232697966a3224a83a77da6df34fe2529cf2dbb94ff70dbb30dd102bfb2e6ec1fbe56","ssdeep":"768:0KzvVjpVMSZIB9k9/PXXJom4MGaf+xf2ja:0KJj4SZa9i//Jom4FIla","tlshash":"8ac2f1f94be6da294a429e73484bf61aeba4bdef5270f505d1c53c38583382588c287c","first_seen":"2025-10-18T11:41:57.577907Z","last_seen":"2025-11-20T10:07:43.559401Z","times_seen":39,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/CQ9-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.718Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/CQ9-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11936\r\ncf-ray: 9991a89e695f0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=12465\r\ncontent-disposition: inline; filename=\"CQ9-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc54ad-30b1\"\r\nexpires: Thu, 06 Nov 2025 06:19:06 GMT\r\nlast-modified: Sat, 25 Oct 2025 04:40:13 GMT\r\ncf-cache-status: HIT\r\nage: 409620\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11936,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f0437d65f21ef5b9bf7887335de8a605","sha1":"93b3f17df22011ecb90d61bde21ee907517233a4","sha256":"934264aab432935f022565e9f714bc83bf39269f43a5cdf96fe81a4585795ddf","sha512":"9db84da7e5e92d3c4f2b2566b5c0d7c9b061c2695e07d4df83526d6e26a5bd0ab108558d59228255bacd24055d494d56ad623c3759fce6a1ad69be50d22ddb01","ssdeep":"192:cBzIUmKpb1topLRIMAkBV9DT/2OOz2ZFeTk1wDWaYI8D4euaX/TxNCN8F0f/apLQ:cL91mpfhT/JOqZkT+w+0euaXLKaF03z9","tlshash":"4632bed6c7818215b2477a7493b48a8f13eaf10e75b434b7465e3677cc02b336e6066b","first_seen":"2025-10-13T04:41:49.961653Z","last_seen":"2025-11-19T04:37:15.650491Z","times_seen":67,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KR.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.935Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KR.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-3a5\"\r\nexpires: Thu, 06 Nov 2025 07:26:32 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146629\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8949d1e0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":933,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"df2ac430f855e8906b0f499caeb73689","sha1":"9785221a46a0a049bf82bd8d70984fd9a5478145","sha256":"a0176d1f7b6aefb13f9233976b017ba8a8da82634b03e8150ccf5f78f4db9494","sha512":"e169959f479370829c63919c7f23463530ad6ccd8ebbb82d95dfaa19b59481f226d1428b436f750d1bdc7aca2fb059245c531c4a9aa44eec10f2fb49b8b97618","ssdeep":"","tlshash":"fa11e275a4bca0264b81c1720e9f71f117a1b1bc229a03bea0a4d954704ff6fb280bd0","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-26T09:26:02.121329Z","times_seen":237,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NL.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NL.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-154\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a895eedc0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":340,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ee9b0bd34dd0925a7fb75bdb10028e55","sha1":"16a39e994d0f4c7d56aee2641ac27e0b19c5bb05","sha256":"0f226a654db8f6150da746d09fea6f738d4cbd7cef54c1ded5da0f1fa9b07a92","sha512":"d6f04dd07db0651ecb35fe22a5f8fd3c472253187d57f6ba0989069e92b19f998b39db8d841df5b92bdac9ccaf3bb0eadf0c5a992c33eda6ff80460cc28d2241","ssdeep":"","tlshash":"56e026a1d0b9bb0dae504aa49e9ef4d584e7a18822c8038df4500914a10e7cb7d85aa9","first_seen":"2023-05-25T21:07:41Z","last_seen":"2026-05-30T10:59:04.295955Z","times_seen":268,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/GCSGAME_newGameVendor?platform=html5-desktop\u0026ext=avif","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.595Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/GCSGAME_newGameVendor?platform=html5-desktop\u0026ext=avif HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: z5qtid2502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 8\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=D%2FhN%2BeDEg5VT69r887YLBl0iHiNZmEZNWEhOY8P9k%2FHAVKB6kHo4FdYVF4yxs8JANcJ8tarSa5y0M91U7Xm%2BuwTV14pkH4uS%2BRCi\"}]}\r\ncf-ray: 9991a898b8e756a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":147336,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c7d5ccbb393d20edb5880adb08e32647","sha1":"1758a95ce9a81d3facbbab33f7ead652ec887f00","sha256":"8b0bbbdf9f0595f97e2621f77bb98335cbd4f8ee0b1226980266bd65c1313467","sha512":"43b261be420e8172ac9595a38ca57a8f77047838d5960b714d10f93e486fec46fb58942bc24ce95c730e178ddcf662e1c723e90fd02a164fea8a581b75bf8b33","ssdeep":"768:fOoxh3SFLA2qwkjII2/XMucnRXq+XBuXR1zG+:moxh30qw5XMucRXq+XBuXR1zG+","tlshash":"00e3236ad194b877033247c876cfbe89951f806f9dc2f715f98d8e08d8f5aa8c264274","first_seen":"2025-11-04T05:20:58.446808Z","last_seen":"2025-11-04T05:20:58.446808Z","times_seen":1,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/PRE-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.199Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/PRE-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9610\r\ncf-ray: 9991a89c4e640731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=10477\r\ncontent-disposition: inline; filename=\"PRE-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbe448-28ed\"\r\nexpires: Wed, 05 Nov 2025 09:47:37 GMT\r\nlast-modified: Fri, 24 Oct 2025 20:40:40 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9610,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d750985158d769bb222d90068d31282d","sha1":"e43ae07901c5f37b063e803013f528fa825ffcb0","sha256":"05472fd87044119f9a47494109c417073c7f79fa40daeacb6a1d5ebc455692ee","sha512":"a6b1886c66fdb7126e0ae63ff2534b204357a8e334e9284ea96083ada83a309794fc26e945faa99aea736bc5b1e04db0a542c974bf1dcf0a4fa19a84faedcfa9","ssdeep":"192:4iOB0fEEOrmpbyaphOz4LRL2KXTMBdRFs23SkeZYGQ51WWg/TqesL8b4AE8OPo+P:pfEEKmpeuYz4tiKmBWZUgWgrWC/jq","tlshash":"c512bf94834e8d7c155afbf8914d50f6638da127ddf01bb88609bda831b0d3f116e987","first_seen":"2025-10-17T01:15:14.98539Z","last_seen":"2025-11-12T06:10:45.725137Z","times_seen":56,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/PT-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.320Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/PT-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5596\r\ncf-ray: 9991a89c9ee00731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=5767\r\ncontent-disposition: inline; filename=\"PT-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb64e9-1687\"\r\nexpires: Thu, 06 Nov 2025 06:32:46 GMT\r\nlast-modified: Fri, 24 Oct 2025 11:37:13 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5596,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0d11619472f88b4ce5338a12fa7a803b","sha1":"cf32b25d47fb8158f7deb2cba70971a51b31f536","sha256":"0489dcbb61d46b88858f4f7f67a93c242cdee3c81c553038ef9fa8bc1ce647cb","sha512":"d47876d92a6bc2f60c98faedf2a82fbfa62de5ca89b94f367ab0020ca6c96ff1d07af670c4f73a6569429a849c6d9ba8151e1ae52c7920346a005f872a57c79c","ssdeep":"96:C0K+mIZsOEVdS++UZZUUUtTQiGU0E62kcUv1KiatE0nwJ4R0Cn:CR+mE1++UiTQiP0E6cUv1RZ4Rn","tlshash":"88b19ef877320d35cc20c492352766c5abc12209633c10e310e9a5977c7643adddaa63","first_seen":"2025-10-17T01:57:50.148544Z","last_seen":"2026-02-23T23:06:43.095536Z","times_seen":101,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BOM-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.654Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BOM-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8688\r\ncf-ray: 9991a89e390e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9391\r\ncontent-disposition: inline; filename=\"BOM-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbd15b-24af\"\r\nexpires: Tue, 04 Nov 2025 20:41:50 GMT\r\nlast-modified: Fri, 24 Oct 2025 19:19:55 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8688,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6c687135a9e8638a45e2bd1f8a018c22","sha1":"136c2a1ce44db4d4b25eb61b1a482df49e18c966","sha256":"846981a5ad9f7c07937d513049780771d7dbc0dccc3258c7c85b1d6edea91bf4","sha512":"74f19943d8a7d31294b6de0c75f7c510f9c4ca179fad2d8035e0fe439cbfff964992d03edc8d868de9381c0d8ef5a71c1b8b946d4ebf50bc282fa82e46faa78c","ssdeep":"192:rYHwOvOWTEgZEyVIRd7veRGmX/cD8c0fyWXTqWz4xwkAIATwZHYUOFUvm/:rMhOcbgteRG6/chS1XeWwwkp4UOmv2","tlshash":"14029e3d6bb6753edd5d16807520178a4222f667460e342762f2ad5dbd37ebe0f2080c","first_seen":"2025-10-17T01:57:49.211739Z","last_seen":"2025-11-12T04:24:41.589238Z","times_seen":64,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/form-bg-1.6b1df525.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/form-bg-1.6b1df525.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/png\r\ncontent-length: 64018\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:16 GMT\r\netag: \"68f70d0c-fa12\"\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 06:31:21 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=7d4EfgjsUK3NnMk%2BewPz3M%2BgSPqrJ40N1TF0RSN91seMWl1urnydGxNbLBrjKZgnkRL0jZZOwI%2F5rpwd4n%2BxtfZc%2BZOND7zfH3Kn\"}]}\r\ncf-ray: 9991a893ad6d56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":64018,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 810 x 483, 8-bit colormap, non-interlaced","md5":"85bd87c54d5a9d51eed8c5373fd1893c","sha1":"9b51181665d2a733bda2b034befc16334b16e781","sha256":"b175022d92371c79ee27b7d16f93ce8a229f5c2dfa5810a9fca4af4e855784cb","sha512":"b24a57347750e67901fc021173a13759def4a5d95878a47fc4c5ebd8d1b865246a5423a95306528ce6b7eb2409cbfda197ed0cdf0b4fb368f16d2ae373a6f25f","ssdeep":"1536:oVcgtcYX875IgGN/+jPFs+3+Pts4A6vFYX9jYURx8+nZDdWM:xWcYXzTItSPtsk2X98UrTP","tlshash":"7853129b1dd9c6f2fc339ab55e8522e8fe410d4203be12558a431ce7b5ce29b97439e0","first_seen":"2025-06-30T08:13:24.160037Z","last_seen":"2026-05-03T23:12:20.808807Z","times_seen":55,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BTI-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BTI-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 13248\r\ncf-ray: 9991a89cef370731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=14842\r\ncontent-disposition: inline; filename=\"BTI-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68ffc439-39fa\"\r\nexpires: Thu, 06 Nov 2025 05:17:04 GMT\r\nlast-modified: Mon, 27 Oct 2025 19:12:57 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13248,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ffc51bcb28f6d4336b115d8baabdc208","sha1":"908e0f43fac558b752207728ea6ff01508efc7e7","sha256":"b976ec41290cedc3f28b3b383975d1576c28399dc813f7bf2d618e6e2aeb4997","sha512":"33d2359400652325dced7fea75f9fd343aef4b53faa06baeceb110860b80b6bea7371a30e0bef706bd01a99c4a4a21c7079db52f337fdab9e379cc833f97b515","ssdeep":"192:SdoZjwZYB+7rSIv8JMnx6ayEvDqnyXaXwBpFpsLF2OtW2ZQNG5i5JPd4QS+nxtP:OoZcZY1IvVKYEyX05vQ4AV4QS+nD","tlshash":"8f52c079a92c9a6d7ab5a02d812e81f871f39e056f3880d5c4c647e37c0072d7515c3b","first_seen":"2025-10-18T11:41:56.923994Z","last_seen":"2025-11-19T04:37:15.526986Z","times_seen":46,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BNG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.597Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BNG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7656\r\ncf-ray: 9991a89df8c40731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9348\r\ncontent-disposition: inline; filename=\"BNG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbfdc6-2484\"\r\nexpires: Tue, 04 Nov 2025 17:46:25 GMT\r\nlast-modified: Fri, 24 Oct 2025 22:29:26 GMT\r\ncf-cache-status: HIT\r\nage: 411033\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7656,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"efc3316c76b17700fe0f4f81d8d1ca6f","sha1":"4c0a1e67ab4dd36395b088ad105e9ab5e575c180","sha256":"8191693e57e0f7f2a1a517c5efded6003a530954d94b1782d005d62985c98cbd","sha512":"740fa8886a6e1484c383063258697d84243e698804a607cc19eedb7eced3db68c791d15b4f05f1138f37a83fa141c8629c51bf60d267d9ef43ba11b65f070657","ssdeep":"192:S6jQ8I2wT7y1sqhM73Vzm0TOPjb6nO4rMEM7cEJ9CqQXSvntZ6KWtB:SIZnS7pTGjO3AEUcm93VZstB","tlshash":"f7f1afe0a8e2ffb994d12dd4f1463ee4b19cb6a7045aae14954f16f1c68024e350c7e4","first_seen":"2025-10-17T01:57:49.458803Z","last_seen":"2026-02-23T23:06:43.007335Z","times_seen":133,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/qrcode.min.0d19c585.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.917Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/qrcode.min.0d19c585.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69044880-4bf2\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=goVmoqHf2mEXAud7JoUxbocUqpbwX5DKIFHrfVKCk0Sb4nfEOi0lmZabJe3uTxsYEey3YsMKCfmh7TBr8Sn4772Wv7y6i5h6TCmE\"}]}\r\ncf-ray: 9991a8a0dc8e56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19442,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (19442), with no line terminators","md5":"0d19c5856e872e3f6fb9d0f57bea8dce","sha1":"ce36bde12504b53d0baebd5ee359631cc5172bad","sha256":"03528877abcd8ec6452eac177f2750c551e57632ac2d855ad5bcd6343891bbc2","sha512":"188cde9b65214ec7d1a4508b462c4251bef7e9a1a9d945535d5cb07b1b07ff4e27988b3eaf5a67af999af17b2737ae04412bb1dce122d44f32590a1123ca4669","ssdeep":"384:2IKSnIPLflpMR++8OiXAAdTRZgMvu4nvqqHHHsglNov3m1xk0ZkGULMyzLyURyy2:GmXimr4niqPDzZuiDy2","tlshash":"0392c4e9f35403a6525d5cc5282e644aa4b0b4272c1641acffb5c4e6e8bcfd1b83af70","first_seen":"2024-12-01T04:34:39.996683Z","last_seen":"2026-05-31T04:40:23.064196Z","times_seen":2010,"resource_available":true,"data":null}},"time_used":605,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":605,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CF.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.381Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CF.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-264\"\r\nexpires: Thu, 06 Nov 2025 12:10:29 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896affd0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":612,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2255e54e479952ea56392f831b8abfd1","sha1":"978c08c43ffc8377eebe79e6511c51383e4570c3","sha256":"64800988f43683be4b4fbcbe1ab8f2723ecb2fd24aa25c5033798270e10ebd64","sha512":"224334f3f96167f7f5c25f3df13ee881e802f2fb192d3a81519c7d995f05921f5cdd070bd7305b1d1fa5b4e3b1dbdd33aed1f360434547ed5a14332796324063","ssdeep":"","tlshash":"14f028a1e678792e8d9147e02facb1e700d2229d66c9129df4842118129e7cff94a998","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.520903Z","times_seen":68,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SO.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.417Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SO.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-14c\"\r\nexpires: Thu, 06 Nov 2025 07:26:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896d8300731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":332,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ba052f96bb8187d86389a0ec479be9c7","sha1":"e9df293ab57c4b4e55ddd54e01f7db4f46b9a324","sha256":"6e348b166eb69e04b6d9e9f91c0be37cdd83f19347c5efc7568804068b858624","sha512":"541e50d446c1ffcc0bee796fe375fb3f7dac78d3aa16b9bf9572dedc4f098861ff781264a90907ca0ca408c921562cc3d36f00aef65934ddef6c3ba098b1f463","ssdeep":"","tlshash":"5be02642e1689a099fa446788f6ebada189f328c21d4038ef8802c12330b7db3a4165d","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-10T19:00:06.769589Z","times_seen":69,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/YB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.703Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/YB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7024\r\ncf-ray: 9991a89e69480731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=8370\r\ncontent-disposition: inline; filename=\"YB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbaf9c-20b2\"\r\nexpires: Wed, 05 Nov 2025 18:07:59 GMT\r\nlast-modified: Fri, 24 Oct 2025 16:55:56 GMT\r\ncf-cache-status: HIT\r\nage: 405130\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":7024,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"bfc70e760b5793a75d80f14609b657cc","sha1":"a4b03d8d621e9bd7018129c3130781c7211a7b8e","sha256":"648072d934c232983de741f169765a9330c22fbf0a0f60af94b6ac83d38a5e6f","sha512":"8a6ddc07d5dbb2f3ab47d979a575bbf03f6f4257d7b131840e837dbb56db17af3d21ffede3fb823bd8698f9a110a8ef15d41b34b70b191436c41b95a38f66534","ssdeep":"192:XiwhwbNvjXYiIiVQ2lpWkkrQyY+xgjtJORj8:X9WNvjoirfRMFgRJORY","tlshash":"e9e1afbb956027a0e78e7faea5329e550cf5a11e4041ed4c2094458bb73025cfb9da31","first_seen":"2025-10-18T16:04:32.045705Z","last_seen":"2025-11-12T04:24:41.485395Z","times_seen":51,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/HS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.738Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/HS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7692\r\ncf-ray: 9991a89e79740731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=8276\r\ncontent-disposition: inline; filename=\"HS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbcc75-2054\"\r\nexpires: Wed, 05 Nov 2025 07:03:43 GMT\r\nlast-modified: Fri, 24 Oct 2025 18:59:01 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7692,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"66c5d238985c67fe2978160fe80de45c","sha1":"ee8f79e4b269406e4aacd4e1ad928e2df8a6d4c9","sha256":"92f09a0b0d10514bf5205feaef0fcde72d1dc63523d9dab5a357090a7c9f0e81","sha512":"a2b34d745d70e9814a4e03a87dc40c4a965b23b5297692214e5b38cfa91468231e0c93c3af56fa421d5d5a7119f1dcafe6ce6cf7cdea92f69ff71627bf02ecbe","ssdeep":"96:m9P+++l9n6Hliawa1ocdVBh+AHAC8RNoeUjQwCb4wDKjOT1syw+ad4ogzjwmYm2h:JzawQR7HqGeUjKb5DKqxsySd4fwmA79","tlshash":"69f1b08354c9869b123fe8dcc69b9f3cd0b9c1d5c898075d90222e85397835547a3e6f","first_seen":"2025-10-17T01:15:15.156576Z","last_seen":"2025-11-12T04:24:41.639098Z","times_seen":96,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/numberSeparator.4c2c3f06.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.921Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/numberSeparator.4c2c3f06.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69044880-1af9\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: HIT\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cpqp1KkwgyJcZ0VYG4y29bZG7YfuQmSYhSy7%2FOmOHi%2F0fi%2BPANHcg6lh2DSnNT%2FSPkVdsEPVe%2Fvefd2y%2BHWndtcvydX%2F87VdIArJ\"}]}\r\ncf-ray: 9991a8a0dc9556a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6905,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"4c2c3f06d44e4213e043745be268fcba","sha1":"26e2182e6c523daf6baaa88679c8510818861efe","sha256":"a2dda5bf0fc34c5f9d6c10b4ea537a5146d3d7a0e7ca6eeb1daa79e4816430b1","sha512":"e5a0e22d1aa5ad675d44dc65a69e340e4de442999ba97b54ecb519bc35174326cd0d63f2f8cf7f82335fab7fd5a5b3e73cf9c3532c4be74752e7ed4c0ab5d1e4","ssdeep":"96:GIOVuXQTvvHfyiwCJd+SYgyquFWqSqyEcdpy5FMRS/bEonL7mOKVrxYdEB0:GIOcXYF1JJYTqGCqyZy5FtjEoUtY60","tlshash":"7fe1df5d72e721728a3f30aa5bdb80016531255bb088d9897b1ccf44af52c79d393abe","first_seen":"2025-08-29T06:24:26.70014Z","last_seen":"2025-11-04T06:26:26.69521Z","times_seen":486,"resource_available":true,"data":null}},"time_used":562,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":562,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/ac-properties.324301a7.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.931Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /ac/v.1.0.1/manifest/ac-properties.324301a7.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 30 Oct 2025 14:59:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69037d40-199910\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ID1hHLd%2BK66fU%2B909rJEh9WEVelW4mGcyTfBPlJhgYiKnxJj1xh3VPZwM%2BRKboYRjnxJFlz7RLluTDlmCY%2B3q1ZmPrNZq54%2FuF77\"}]}\r\ncf-ray: 9991a8a0ec9c56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1677584,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (36605), with NEL line terminators","md5":"f02f259570c74ffb28ddc7afa3734678","sha1":"9d8b26e5cc408b71732ef98037e855465a7c2419","sha256":"645135e0665d9bc4c1f54120663cd850f5672cbc89ed1a9cb7421808f76be45c","sha512":"92688a2e743994bd3c581d1a8b1549c6b0a4e3ccbe43abbc0cacd3ef23515a65bd070a8645bf6c0eb61031561c03172db3b40c43f45d2702194a9f763694af0f","ssdeep":"12288:PtZENyV4E+sByIdrKxvr7KhUtoN/1EvyZTc9LfVem0ZAjTwDyrQLlQfciS4P1O/Z:PqPro","tlshash":"1e6508a08d1bcb55c9ee314274893bb0c59ca936d188e7cfd85e5fdd22c5cbd820936a","first_seen":"2025-11-04T05:20:58.454722Z","last_seen":"2025-11-04T05:20:58.454722Z","times_seen":1,"resource_available":false,"data":null}},"time_used":604,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":604,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BY.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.270Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BY.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-2a4\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8962f2d0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":676,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"58ae33e6909cf72dbb9fd53faac7470f","sha1":"8b734cd2f5dacfb78abcbe6e27b93f05c70153bc","sha256":"17f35987237a3d9986baf3069e9bc4c729dd29f6a55927d4ff71a5fcb46ffb35","sha512":"5cc7b5eeb89bc626282dfe9f5fd8e017d41a01f312e3cc21bccef676491aff2bc5ce872f5239edf31770538520f474e97970699aa38ae71ed4332bf0efd77233","ssdeep":"","tlshash":"2a01dd51dcfe565c9900c3bccb0cf2852baa1318128e927af8e90060b035acff8d4d79","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-20T06:46:13.723787Z","times_seen":90,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TGO.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.340Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TGO.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Wed, 27 Nov 2024 11:22:23 GMT\r\netag: W/\"674700ef-252\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8967fb60731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":594,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b40b5851491758034b1292a1b6e7d7ef","sha1":"412d5945959e539c1f6186deaceace3e41d8b18f","sha256":"891b715ae0eef35b2cdcc8f7f3442d7db2d6bad82015b4ece7ea24dcf715f04a","sha512":"8b5933fb1d2251b663d8f130b7954ba150d8ff6e279ad4721683b1c9d5a55be7668e6ee69ad2fc1168a519368adc359ce708f5cc93b907a3d1fb217fb016c849","ssdeep":"","tlshash":"0ef0ac55b1b473185d890fe46b7de0d9109b308da19c1289f88e1628a51c34f944ba88","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:55.997128Z","times_seen":69,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/RW.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.410Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/RW.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-22f\"\r\nexpires: Thu, 06 Nov 2025 07:26:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896d8280731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":559,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"408bebb0110eca4e236ce302ef3688d1","sha1":"d537de2f7e32ce1dfb21bdf67517e9c9434d3191","sha256":"2b45b5ed15eb753b4762c98dfd5a221ed98c8216b63b2758fc85d5da29ee6070","sha512":"b3b694c29e7202e6ec86fe1a74d5caefef40c58a48cd1de3cfb775aab4774c3a0ed7c67e327b6b32bf746597ab53d13d3c385940c97f51d8191a5ade0f844c14","ssdeep":"","tlshash":"82f08b858278512cec0043781e7db5ff44f7654e22c4034db8087940328c3cfb405ad9","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:55.973716Z","times_seen":76,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/WE-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.229Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/WE-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11730\r\ncf-ray: 9991a89c5e7b0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=12190\r\ncontent-disposition: inline; filename=\"WE-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68eb1ec2-2f9e\"\r\nexpires: Thu, 30 Oct 2025 08:03:57 GMT\r\nlast-modified: Sun, 12 Oct 2025 03:21:38 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11730,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2d35d367cad75283f875bd02ea2361aa","sha1":"54fe38da303569abccc4f274df57a01cc78c045c","sha256":"09c3d94f1288ee2d6ebaa32139c82a26f4bb1565d261a570e137fa6aedcfbe7f","sha512":"2c1d5cfbdb40de0596801651a8048497ff9171d2bad73de3793a399063ed02ec027af3e91c98458364fb14899f5caf404d840eafa73cbf5ddc64716f34fd0d58","ssdeep":"192:D61WsW7hjWQLd8uCRZBkI+MmUKA4nC0+nsSVgXtc9HXvTY:u1Wb7hiQOAvMmUYXBi2tsX7Y","tlshash":"3a32d0b9879441ea1628dc4accc7050e45e5b18ce7b2350af0e0dd90e8f4f37679499c","first_seen":"2025-10-17T01:15:15.749813Z","last_seen":"2025-11-20T10:07:43.570277Z","times_seen":49,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BOS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.244Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BOS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/png\r\ncontent-length: 17020\r\ncf-ray: 9991a89c6e910731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origSize=19032, status=webp_bigger\r\naccess-control-allow-origin: *\r\netag: \"68eb8f8c-4a58\"\r\nexpires: Thu, 30 Oct 2025 08:03:57 GMT\r\nlast-modified: Sun, 12 Oct 2025 11:22:52 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17020,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 600 x 300, 8-bit colormap, non-interlaced","md5":"8a9689686cfa80db9704b8b6c3878627","sha1":"0e5822b6904dad3a1de0ccf5b4ed5f32b22052c8","sha256":"5fada817c5d5bef21132927068deb0c9ecf5a21fa872cc994c9726bff961195c","sha512":"b53ee2847b6aa1c2db4b758d2aca61e0e3c220c8851b7676ea0328214a1cb3e44bf2fc2fc1bc5af49482e131a7a6b1abebc059e954cbd2d43d45c0f776465557","ssdeep":"384:9JeowT6ion1mwZ6tEN8DMirvtvcYCU4cxsMm1w8FcM9pB:PionBcENHijtbCUFxsy8WkpB","tlshash":"2e72d196659179afcbe525b28f7426bb9cb8ac170c29fe12c20e11d34f190ff8f45052","first_seen":"2025-10-17T01:57:49.81519Z","last_seen":"2025-11-23T06:53:26.256817Z","times_seen":46,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/JL-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.528Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/JL-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 22592\r\ncf-ray: 9991a89dc85c0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=25452\r\ncontent-disposition: inline; filename=\"JL-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd993a-636c\"\r\nexpires: Wed, 05 Nov 2025 16:21:59 GMT\r\nlast-modified: Sun, 26 Oct 2025 03:44:58 GMT\r\ncf-cache-status: HIT\r\nage: 411033\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":22592,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c6e430e56b633c4f5f6a71c3eaf79fd0","sha1":"24e6a83f8bccbc0d338cdcadfafc6019813441e0","sha256":"79d08fdbb52ccf80d7f95deb4537e82a2a422e80fcaaca9ae2ab37e15fe751f7","sha512":"bef097f8bb49e631620f3a16dfb53127a701c6493f4b1408170a42cd92f4cd8b19f3ab952337872e1df7a04e0cf0885961418f19da4515a05f6f936af1dda6ad","ssdeep":"384:KD7yUyG/V5mN7GCshKUhIaPKh4fwfagmnmAEamOW95Al0WhfF31F/7:ISGNq7hOZhtPEfagmHVl0Wxp7","tlshash":"73a2e121a848d93327dfb4af5d14109da963a79c2ed7e211fce7cd9788b00cb6881176","first_seen":"2025-10-17T01:57:49.352492Z","last_seen":"2025-11-19T04:37:15.531946Z","times_seen":108,"resource_available":false,"data":null}},"time_used":15,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/MW-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.629Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/MW-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 24668\r\ncf-ray: 9991a89e18e30731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=25113\r\ncontent-disposition: inline; filename=\"MW-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fdaa48-6219\"\r\nexpires: Thu, 06 Nov 2025 02:08:44 GMT\r\nlast-modified: Sun, 26 Oct 2025 04:57:44 GMT\r\ncf-cache-status: HIT\r\nage: 397966\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":24668,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"feeb8fc1054cb2e8b2c82eb80c377ca3","sha1":"710bf689b982cf4afec757f504214450d5245d30","sha256":"6bfc058b740c3d596e8b18206f5b8ef1f5aa4d1abb499e296a4f4cf1bb2bdc13","sha512":"5486faf8e8efec2f22e051dec514a98e423b07864a3d861000da20ffa59fcb97582949a374efc8156444aae175d94c227b76d433d91bd01ed09b5c0d79c8e7ec","ssdeep":"768:dkFT20YsE93e2PyM3L3F0eCIwmhedys/RF:D0YNDSpXmQjT","tlshash":"25b2f111f46b94aaa401e8fdb5c70bf39cc2863510c15a9c3081f6d25936e768eafa5f","first_seen":"2025-10-16T05:46:53.968168Z","last_seen":"2025-11-19T04:37:15.476438Z","times_seen":81,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/AW-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.712Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/AW-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9108\r\ncf-ray: 9991a89e69560731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=10000\r\ncontent-disposition: inline; filename=\"AW-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbeb5f-2710\"\r\nexpires: Wed, 05 Nov 2025 17:55:47 GMT\r\nlast-modified: Fri, 24 Oct 2025 21:10:55 GMT\r\ncf-cache-status: HIT\r\nage: 409620\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9108,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"58c39633fdfa853d5ee122c24457f29b","sha1":"184784f42e2e0fab2afc92ab584a400993149589","sha256":"10f5ddebcd776eef674de2eba5d102d640665c0144fa9ab550c8aeef396a0615","sha512":"12ae037a4736bd7930aeff35a47002b32dd9a671bd1494999be83f63c0d101c4d3e199ba48d1e25994e29d4a854e5e663e117ea38a563eced3e96fd9e3164388","ssdeep":"192:eaQv08+uo70qVNA1UFgXUGTGE30mrXpIU020U:eqC1UF/GT330mrZxV","tlshash":"de12ae35d2783627f7a69a64826b1dd0a0d4ae1c3c5e59113c3a743317fa0d3c84b8e6","first_seen":"2025-10-17T01:57:50.11537Z","last_seen":"2025-11-12T06:10:45.679874Z","times_seen":63,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/RegisterPage.03d7cb36.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.602Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /js/RegisterPage.03d7cb36.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0d-62e\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 06:31:19 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IshMu5PwfAp%2BPAfl%2F0jwHWSJzh9AmGFgk0GTpw582fXG1ZWNG45ByNrlkCoL7eGtPaKjFFNaNWtAN%2FYHW6tWkrcQSkckGQ7vlVky\"}]}\r\ncf-ray: 9991a8928cd456a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1582,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (1582), with no line terminators","md5":"c06ecd82ac102f8abc7e4f9461364c34","sha1":"00e4863cd7ed4c6a5904bdd95efc8bbc4390a88f","sha256":"59b2f5a4c86cf7a3554e20b80cea4c9e3453c03ce2651ed4c5eb998c6237192c","sha512":"7b875e876ce8a578cd5f9206219a664070bd192c66ee19806519e557832f7165d01db628deaf1d470c85207c609dee80ed95f9f6d3a1ec13b5d7e2cb1a59ff39","ssdeep":"","tlshash":"b731331af0d2fc76df92706560bf0425916b2e881d1589a9f374e8c05aee0cdc423b7c","first_seen":"2025-10-21T06:00:22.05809Z","last_seen":"2026-02-09T06:38:35.128217Z","times_seen":29,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KW.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.218Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KW.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-184\"\r\nexpires: Wed, 05 Nov 2025 09:23:17 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a895dec10731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":388,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f236070f2b656334445a684af35fa9be","sha1":"3c3feb007433a17671126de0b7d9b932046d9205","sha256":"3dc308356979f1eb7683a1581acd074e82e2dd765c6e9e715bc4141cba543bbd","sha512":"280c68946b72876339f2a1ca9f8f0728233247a0ae1024591b53960e93d2ba5f7f2e2311346c7922aa7a10adda1b826805c718df4565adda99c64de239507c91","ssdeep":"","tlshash":"cde068a4e8b8764d6e060be8afddb4c14193b39c52c4028ef1001e30212c3cb384176c","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-27T05:04:05.956972Z","times_seen":97,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ET.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.414Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ET.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-27b\"\r\nexpires: Thu, 30 Oct 2025 07:12:29 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896d82c0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":635,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0dc00578ef7b9517ab80907ed7be589c","sha1":"bcef42dd7e02c7becba01416442dde68d42684f2","sha256":"4ccac775043f9fae793ec698558ff35468bd8d6d02ee7caef7ba1bbe797908fb","sha512":"4555a501eb64edf4be6059bf857808a4ffd43bde20e2611e5aadb95e4baed681c8736cb64066abbef198a7b97b9d9ff2a573eeb230cfeb442522a238c9c3384e","ssdeep":"","tlshash":"d1f0dd51f07bbb5d9e2107d45b0ee8f114a271954ad1038db4400a34710e7cf78ca5a4","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.088493Z","times_seen":82,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/drop-pvp-img.69067690.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.776Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/drop-pvp-img.69067690.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 53262\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\netag: \"68f70d0d-d00e\"\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:49 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: EXPIRED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2ntE45wbouIHw8gKwLATAZVla7C4sb1cpz7TqVjySK80w6BDRwpX%2FcUE4DP3r6b1cxALrleNZSGZuEmghbJgd8o0QesgZtoN%2BTLC\"}]}\r\ncf-ray: 9991a89ecbe856a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":53262,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 458 x 447, 8-bit colormap, non-interlaced","md5":"a72a38ed8aa1aad9e58e0aabf6ec8093","sha1":"546547c4bd2c6ce9292b09118a74f93976da1c3d","sha256":"7f9a883541bb1c00d9d87487e6013aa2b44817fcdd72304dec44e0f718eff39a","sha512":"b1a6da6086b01503e2c090bff999d02ebe6b7ea53a70669a9321821021113c135ae0d8b17edf1ebc4e2d1f5554ea72ce9d1ce004b1267341dbdc2413187e0bb5","ssdeep":"768:ImZZ3N9VP/M9QmwknbOxqyzmvaZA08QhThEvw65H0eCtEoLkKELO+WHU1+tlUp20:7DLzknbOqIzlhEh5zcvkmP84sBAMv","tlshash":"c433022fc40855b4e51c4b2ec5b820006f1be7ddbc494b5a8fd84b526b799d9a2827fc","first_seen":"2025-08-18T15:26:48.854782Z","last_seen":"2025-12-15T03:55:58.477686Z","times_seen":68,"resource_available":false,"data":null}},"time_used":1170,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":595,"receive":575,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SL.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.377Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SL.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-154\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896aff20731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":340,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b40874c7aad54ff1696b0c1828611780","sha1":"39a9b07f23a6ccb93eee81070cbede20cf04f940","sha256":"cf156b7a6363b9746cc98956fde4c288b6baab6f2186e4be4533ac0bd0218d06","sha512":"2e4f44ce249b027f7118aa57b5d8246f25a30dc9481248c6b71eb49efdf9f4b4c4305b6d13f5018d39e1f31d2c429a3552d2b1af548cfbf44ae6f88141275397","ssdeep":"","tlshash":"f0e026a1d4b97b0daf504ab4aedef4c584d7b28c21c8068ef0500d14a11e7cb3d85aa9","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.154819Z","times_seen":76,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/EG.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.474Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/EG.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-20a\"\r\nexpires: Wed, 05 Nov 2025 07:29:57 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a897088d0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":522,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"662494cb6796d70cc87c894c3bc17bcd","sha1":"677afef9392def2fc5515ca517ff23c8b28e7b76","sha256":"beadec3f831d66ed0d733a4ad8061c287567b30ae0c048f82c3d1e909c00882b","sha512":"0f33af25c2268f420e14b53d27af7c272372bf55dce33a3457489a3ebe4549ddf847458f0558de456b109a269f78756ed54ec33fedbfb5c284e02f937292176f","ssdeep":"","tlshash":"0ff0599074b9a90ebb6557904f5ef4c20567b1cf62d6059bb04088a1220ae8ba845798","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-22T19:21:41.088712Z","times_seen":242,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/RT-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.660Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/RT-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10588\r\ncf-ray: 9991a89e49180731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=11445\r\ncontent-disposition: inline; filename=\"RT-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbf5c7-2cb5\"\r\nexpires: Wed, 05 Nov 2025 18:47:36 GMT\r\nlast-modified: Fri, 24 Oct 2025 21:55:19 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10588,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"2a9590ee666293f1fbee984b57bc0b5c","sha1":"1a0bf7a1300c71d03697b084989b56f2075ba547","sha256":"1c9678ee87c64e4479ae0370ee6048aa625f27568d63ef186adf1b7e02e8b9f2","sha512":"b6bbd854fbe552997f6cb15215c71dc58901ee4c59217d2b1febffa1bfe6f9ff930f54bb4a89deecdbe802e59d7b9bf6353f448cef6da1f16b1abca5a4ba94a3","ssdeep":"192:jE29i/mqVNZOc/Lbkyl9vwicsTm/TSET7S5wGVhcKWt1NHmoZlVHVUh:jE29VqHZfPkyLS/b3FKoNHf3V1Uh","tlshash":"7822be814711f0f485c48478d215136ae7a591c799fcfa8db4e10fb4866bfa9538df82","first_seen":"2025-10-26T04:38:29.647699Z","last_seen":"2025-11-19T04:37:15.665615Z","times_seen":65,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/mc-control-shanshan.67a67df3.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/mc-control-shanshan.67a67df3.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69044880-11299b\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FC25RdGtEJiqo6MHCLBtrkhWmNkO6y2hCdYEfbTNeCr4fAwyb8bOfzwe%2FnRcrJKEjzLFp8cy0xjBNOxvKm2RhJOK0Cgq0B6V%2FHaA\"}]}\r\ncf-ray: 9991a8a0dc9356a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1124763,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65460), with no line terminators","md5":"738938ee55162f957d2c7a8ff43ad4e9","sha1":"9c7a45cbfac94a1fc5d78cb1bf31dd07b53ec540","sha256":"ff5fb764e472309f6efdb017dbe1e37118bc0612bfc3709d49e3e1a417b1d25e","sha512":"a3692a154d8ec3e36dc211ab704377a1596a5353d7d1195c1bcf963152668aa3666b88598f2d2b046247a0d9c4bebd00369f3c85a5980029da56ab7babd79811","ssdeep":"12288:Lq8ptRpT4EHWnt575j2gToVYOPCTaStX/AoZiN9AQMp1NONNMCA3gm0fEtfJ9BNs:uUXarntV5jk7ItfJ9BNMgSZ54Q","tlshash":"f525194471e260e3117b7266609f66052676be32c40a4841f1ae99f1afbdd85f333f3a","first_seen":"2025-10-31T11:25:46.465413Z","last_seen":"2025-11-04T05:20:58.464395Z","times_seen":21,"resource_available":false,"data":null}},"time_used":671,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":671,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.928Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-2c1\"\r\nexpires: Fri, 07 Nov 2025 05:31:48 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146629\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8948d110731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":705,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"daa4b5a7e549d7f7897e5101f6dc5131","sha1":"8c71c63dd0b30e8050386e0fc836edd0d7093089","sha256":"73d72f59389845361b0d59623fc60b0e47ebd6c9623df706e8d8b079baa3af64","sha512":"9d0bd68c6621e2e3b53443438bb0650fb56d50824321bb3c33924a538ac57cd455e73826b8b86b943c63db82479ed29e6172e82dbe2f88ba399e7899f813e67f","ssdeep":"","tlshash":"2401cb78f2ed9b389f50d3781f3cf5c4355b02cd01c1030c6a9148a0b1c82cde588ad9","first_seen":"2023-05-17T21:50:12Z","last_seen":"2026-05-30T15:53:57.990695Z","times_seen":380,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KZ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.283Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KZ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-2c8\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8963f400731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":712,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3d973b6d79281a3fb5b92f1c5a560ecd","sha1":"b37917274ea5ab442ccfc3d38570535c817c859b","sha256":"059b6bb1003455efc94c13c2b9bb6f2593f1c5cd8a26ac59da5345a7f99e643d","sha512":"c12666234566de6b6173f5f7c2609d006e901ffab1ba5dc9948f6d18cdf5ea7c3baebb4074ca0993e843121336e343cebbf596117db0f2a354a6412166f07c44","ssdeep":"","tlshash":"2b014c618754667e790043b0ce7e70ef25bb214e3190014dd954e952214c7de7d6b98f","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.169324Z","times_seen":91,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.300Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10228\r\ncf-ray: 9991a89c8ecb0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=11028\r\ncontent-disposition: inline; filename=\"BB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc088d-2b14\"\r\nexpires: Sun, 02 Nov 2025 02:27:16 GMT\r\nlast-modified: Fri, 24 Oct 2025 23:15:25 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10228,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4c1880c2653b13e663510383050fe5a2","sha1":"a305d073dae3a35d472d01a9f2cf3204d9c596a8","sha256":"aea8966e637e13fb7f52ece81949b3bb4bcfbb9e47e1234a416d1694d9cfa5b6","sha512":"141296410173f20fab8c2f3526999c474802c72f20a57fbde696ce4757bc7bc2714e37ed3060f656835edc32b28a73c96674f0ca76aecb6a0f2650872de6a461","ssdeep":"192:hLWGmzjQHKpFV0sZ0hlfITqZQTtwz8MhStE8NsPeqQ2ZBITf:hLWG6jQHKx0sZ0TfbZQC8MhSuPe5Tf","tlshash":"fe22bf999ef31b5503b789b44a10646949c38cdddd8a591a3f33c53b4d11628a8f70b7","first_seen":"2025-10-17T01:57:50.06906Z","last_seen":"2025-11-12T09:10:09.462499Z","times_seen":43,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.360Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 18544\r\ncf-ray: 9991a89cdf2e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=20651\r\ncontent-disposition: inline; filename=\"SB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68eb76e0-50ab\"\r\nexpires: Thu, 30 Oct 2025 23:06:26 GMT\r\nlast-modified: Sun, 12 Oct 2025 09:37:36 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":18544,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"34db5710fc9aac6db4aba74279cddd00","sha1":"291fb63bb588547bd03cb50cc58c728ab97a93a3","sha256":"967e2e504593961f60b245812cd2bdbebcaf8c255371c046555907c720f8f368","sha512":"181194598e0640786b4441e86bf8f625006471f57ed76bba1ecde5cbe3e41d8ca53db897360df6f034356dd4913e807a74f3fc3f63725b4ef7c8c5f10e8c3497","ssdeep":"384:eoinfFZeSov1lpzCYRFA6dVRC2y24IBuWVl8KpNt2R9fN4CsYdkNTviEjzzi:HSS1l0Q26dVRC2y24IBTVWAMPfa1NThG","tlshash":"fe82e0758ba055656f9243c70efd358eb37e40d74cb9e99047c7b69ad180618c0e3ed2","first_seen":"2025-10-16T05:46:53.950908Z","last_seen":"2025-11-19T04:37:15.652627Z","times_seen":58,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/LCC-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.787Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/LCC-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 54948\r\ncf-ray: 9991a89efa230731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=59319\r\ncontent-disposition: inline; filename=\"LCC-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"6900096f-e7b7\"\r\nexpires: Wed, 05 Nov 2025 19:41:30 GMT\r\nlast-modified: Tue, 28 Oct 2025 00:08:15 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":54948,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d27fd0d416cfd9d04b511e62844cc47b","sha1":"6c48a5526227dfc2e967d94ef501b606180da1c4","sha256":"910b065a80aba3ee45bbe69af709ed9f0db2e8033157425903ae0302056b0ad4","sha512":"b92ab29cacc301f4ce39627e7834bda74b573507a55e632c4faf0ca78d13de7fe2588809a1af6a55e9aa8facf81896a2ca9330da740c00292431403053da88f5","ssdeep":"1536:7LIgcXFhWd5bo9foB7daxfnI6mr/L1iospfrF9:fafWd5EeBsI6K/L0ospfZ9","tlshash":"f43301f055861e12ef30e54094d557af6a83e939a23bdbcdd1cf8660fe25b98030d72a","first_seen":"2025-10-16T05:46:52.787771Z","last_seen":"2025-11-21T06:16:50.141271Z","times_seen":51,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/drop-elott-img.b4be450f.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.792Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/drop-elott-img.b4be450f.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 49390\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:16 GMT\r\netag: \"68f70d0c-c0ee\"\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:49 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=o9O%2B%2FQAXu71BV8WaYEoD3T4ggbzQgTpmeTTl2ZtBIQIgRUdAyMpQmV1h8L6VLVAicSknOmxmcw%2FGu7MnsbX56rKG4Ra6EnNylykr\"}]}\r\ncf-ray: 9991a89efbf556a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":49390,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 431 x 442, 8-bit colormap, non-interlaced","md5":"d841fcfd176e4210bc0d044471a4caac","sha1":"7e311ced0cee6a22a98bfa1fbaaa8130c4acb281","sha256":"60c2a580ba8a12af240cdced06f34625ee2d1077d2370d864e1a02da31153fa5","sha512":"161b1b003f00169de181e3d9ad370b4b1a429992f21fed490aac4fc37773b8bf6088c742233b86992f16974159c40f00479242b52f628d253e532e26efa0812f","ssdeep":"1536:6RVc2Yol2FDX5kg1zRiPU+3dt7Xev0NF4gXrSEhb:Udx2hZp4M+3bXecNFvSE5","tlshash":"e923029c826e7a15fd61e421d716fea431081c9af1024db8a7b8cddcb2621bb35f7285","first_seen":"2025-08-18T15:26:48.753433Z","last_seen":"2025-12-15T03:55:58.390083Z","times_seen":68,"resource_available":false,"data":null}},"time_used":1104,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":566,"receive":538,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/lotto/lott-common/bettingCompress.22844977.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /lotto/lott-common/bettingCompress.22844977.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Wed, 08 Oct 2025 08:43:38 GMT\r\nvary: accept-encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 18:07:19 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PILLr4b5XaJ%2FMs26yue5wjyb%2B3RcOHx5SGgosL44Io0%2Bm%2FNlvO2sKmVmRryhWWTYyB1E4BV7FJ2yV2Vy4ra%2BAmws4ZCsNOoVA1hf\"}]}\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\netag: W/\"68e6243a-35f\"\r\ncontent-encoding: br\r\ncf-ray: 9991a8a0fca556a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":863,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (863), with no line terminators","md5":"0e9473155c92891f4386dd0d8069e9f4","sha1":"9267afe6b0d97cf53172044ae9a42265d9a3d363","sha256":"a0e031682a12d70795625a3dc3b2ef78cb8e1df947e2624b6af6e4c29f51ee1c","sha512":"fca9d9ce963c1d918968709e1d4cde135d229c86f061ebf6424e7795b0f82a387090afec4e53a14f6b08b4b818bccaade875977c4b9240694221c067b5ed9624","ssdeep":"","tlshash":"e611ab5930c1699a12a2f568c90fb31e54664e2012cae018ca1ed88cbe755fa85a2da8","first_seen":"2025-02-23T00:29:24.577675Z","last_seen":"2026-04-08T06:26:49.892621Z","times_seen":2022,"resource_available":true,"data":null}},"time_used":44,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/aboutMerchant.js?v=13424","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:45.192Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /js/aboutMerchant.js?v=13424 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:45 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0c-7c0\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 06:31:13 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=4oJmWoKsavmARNMZbAki4WRvl%2BetYS8GCkafgUOrSqcRrOxmhCVNqnL4kLFuG9TDH3YKYj51lvLF0T6NNOUnTBhJeHRXJaDkAkf6\"}]}\r\ncf-ray: 9991a8836e1156a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1984,"size_decoded":0,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (1890), with no line terminators","md5":"568403915c6cf2c3eecc0a299a35861e","sha1":"bdf3acedc4179c060a0ad0ec73032de39e7c4c0b","sha256":"a1e6867177e1d5a22d21ce39d9af84dfd9464457beb55b923f969f9c66057164","sha512":"4c8bf3dfab872448c88693036e62a98481f8ebc7add84670daab327c3e14142e0a4480d8e251943491346b47a9f88349cc7675c24eefcb85eaa0d858a0e45930","ssdeep":"","tlshash":"d941539eb14bebe205f620822ac56219647360d804b6e4817b569540b47ee4fc25f9cf","first_seen":"2024-12-22T03:03:41.35822Z","last_seen":"2026-05-31T04:40:23.160623Z","times_seen":454,"resource_available":true,"data":null}},"time_used":47,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":47,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/PROMOFE_getPromotionAnnouncementCategory?","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/PROMOFE_getPromotionAnnouncementCategory? HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: 0fp4zqa502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 2\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BO4iT0EjJSE5ApmD7FJdHCamVpPDygoro9fkECBI1akoLu7MnrNPubMdOSUzXvNBHjUtX%2BA2tlhI%2ByHJy5ZjbvhwnAL6evTbTvH%2B\"}]}\r\ncf-ray: 9991a8931d3156a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1394,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3247e8ea9a6ae780f326812706a97cb1","sha1":"67baae987e2e5e400a247f7541a3c380ef0303d7","sha256":"21d617d1cbc4638dc929606737cf20afb96befc5e5eea2e4226bb2ab611a07b6","sha512":"36ca671fe167feddf0960ad4185ccc589c940bb1450b5c6185d4cd6383cfc669036a8a9684c0df3c856cc7c7f20e0e6f0540751b15c260729a4101cf98136395","ssdeep":"","tlshash":"97212c015d6c9c34c37c2ed178c7feb996ad3607f4f41e70609c9ab894a9ba4a01277b","first_seen":"2025-08-18T15:26:48.807723Z","last_seen":"2026-02-09T06:38:35.020021Z","times_seen":79,"resource_available":false,"data":null}},"time_used":390,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":390,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/HN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.299Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/HN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-30f\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8965f5f0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":783,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"94abe2f41dbab8b161a979077d336d93","sha1":"8b029007cc2b6696d1fd3759c4c48734ab94fac0","sha256":"28e32e150ab0d520953967f65cb42fa790a8462e244f4891dfd3d4c1d431afbf","sha512":"b174b86d49c2de5303687d0ed45af08652018f78d842f8333cac8bb3a5890e68c1b5b5a737db69b6754b5d2c483679c72d2d15abe9b7a9ed41a68b4749428f06","ssdeep":"","tlshash":"1401c442c3a5e7614f48c2b0797c76dd042352aeb2acd34c792a15b021ec5efc53cd59","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-20T06:46:13.978716Z","times_seen":85,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com/dev-images/GCS_VENDOR_EVENT_IMAGE_ICON/3006.png?t=1761547400410","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET /dev-images/GCS_VENDOR_EVENT_IMAGE_ICON/3006.png?t=1761547400410 HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 4964\r\ncf-ray: 9991a8a3d8df0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: status=format_not_supported\r\naccess-control-allow-origin: *\r\netag: \"68ff1488-1364\"\r\nexpires: Sat, 08 Nov 2025 04:04:22 GMT\r\nlast-modified: Mon, 27 Oct 2025 06:43:20 GMT\r\ncf-cache-status: HIT\r\nage: 251420\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4964,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c99f52001998101e6cf0f878bd470c57","sha1":"04797055bc2c35bebb31c22f4164484d6b64237e","sha256":"edceae3155fadfbea18126812233907d37bf49a5b0068a35ff83d0b87ec6a501","sha512":"47b744632679346081366229869bf1e2d29a14d45f85b12bcdbfe59389c6e0ae4664ec54826c72b9a4d38dbef8b167078caed8ccf4962eda7acf55aea205189e","ssdeep":"96:vmEZX++z625QsPf3q2jXwhtzmPAGc93RzJ6WBjGXx7SQJxwCEMLMMBdvs:vmEZ1m+9ZXwfKPAGcvzLoI5Y6","tlshash":"94a17f2b01d07c27a96e553ddf6da03ae379504413b14ecab824e1d01d1ea5f991bc43","first_seen":"2025-11-02T09:33:15.735539Z","last_seen":"2025-11-29T10:14:58.367599Z","times_seen":28,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/assets/resource/CASH_VOUCHER.de07402c.gif","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.406Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/promo-ui/assets/resource/CASH_VOUCHER.de07402c.gif HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nX-Moz: prefetch\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: image/gif\r\ncontent-length: 480199\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 03 Nov 2025 07:10:43 GMT\r\netag: \"69085573-753c7\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: EXPIRED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=iww2gG7JtJUesxyNQKCx%2B%2BhZDYcJiEZYL5kJK%2FNlWoJnXNkUp5CcCsAgfgMOXuFPDiMA5iK%2BGMESJNPXR0MTRi8s36saz5F2qeZG\"}]}\r\ncf-ray: 9991a8a40db856a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":480199,"size_decoded":0,"mime_type":"image/gif","magic":"GIF image data, version 89a, 200 x 200","md5":"b37c4bf2a7dbb9f77d06dd432864a7b8","sha1":"32c34b2fe3e519fe7e4bbce966b0477fff61ed25","sha256":"46ed3fc4723e5b202d269dcb5b9c2165df51ae3dfd6a4e9bba825792c3dee020","sha512":"645a1c830c7542ba3678d639e8066a8cf2920d4845e8e6b3d262e33c875927666c868fcfdc5da2cd1fe2720b7a2a7717e7ec63bb6aa2bc106152cd065b5614ea","ssdeep":"6144:QbVo+HnBZbztBvOBcbSBBH+Bxi6BBH+Bxi6BlvdgHIWVd0GYFHBSbWbpfTR+kUq4:gHBZVBbGvwIWVdZ6h4W17TXeUDKovJHk","tlshash":"03a413ca73fec0934d18fa861a871174075c8fcc05d8c27b562a65a658527aaf7b23ec","first_seen":"2024-07-11T14:40:33Z","last_seen":"2026-05-31T00:50:48.274542Z","times_seen":1937,"resource_available":false,"data":null}},"time_used":1257,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":371,"receive":886,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/FTG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.698Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/FTG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3124\r\ncf-ray: 9991a89e593a0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=3730\r\ncontent-disposition: inline; filename=\"FTG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb566d-e92\"\r\nexpires: Wed, 05 Nov 2025 19:20:37 GMT\r\nlast-modified: Fri, 24 Oct 2025 10:35:25 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3124,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a2c5c0bd57e34c64425c48a60e7f686a","sha1":"1c66b742264210c1dacc31dd1dd222b06368d40c","sha256":"f220bf476e4e11ebfb7573e6041110d557798ba338374fcec0fa42d6205daf33","sha512":"5beb1c234dff0d29f231a62cf6b6a25003fb31a993a90cd3182568abe37b6d14c2d2d31c565675448b568c88c218bc9aa2263bf89dc1321952be52ee21b3d429","ssdeep":"","tlshash":"53518e30b35b77c87f1ad6349cf1c0454cf5485012d27abad5f9e2915d7c4617bd0549","first_seen":"2025-10-17T01:15:15.354641Z","last_seen":"2026-05-30T23:19:01.681411Z","times_seen":206,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/RTG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.722Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/RTG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 14552\r\ncf-ray: 9991a89e79680731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=16356\r\ncontent-disposition: inline; filename=\"RTG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fcf763-3fe4\"\r\nexpires: Thu, 06 Nov 2025 06:29:21 GMT\r\nlast-modified: Sat, 25 Oct 2025 16:14:27 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14552,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"868615e1cf413a9da4935c9647a754ea","sha1":"98d4194dc6196ddb8b646e9e3a732a0f9f6382c3","sha256":"c1e9d1752adf8b037a38d6f9bdcee345627dcca0f640e0e8c81c7d1d7b591791","sha512":"4a8fb9f1a90e6f649331ec5b34190a001282fc5a81261ca0fcca830902fae4506cad745d431e06504b0eb772a6d4de08964c5269a5527de4bdf126887f591c3b","ssdeep":"384:DyrK/bl9TcabY7P28aCPkt8UgWRCXMaiGZZBji0z1IKx:DDzgCQ28aJ8dANaiGZZBji0z1IKx","tlshash":"9562c0d2d948a01818a1744824388727bf36afc4f3af99a476fd6df89020f1cbdb4c64","first_seen":"2025-10-17T05:10:22.538312Z","last_seen":"2025-11-19T04:37:15.650968Z","times_seen":51,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BEN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.315Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BEN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Wed, 27 Nov 2024 11:22:23 GMT\r\netag: W/\"674700ef-164\"\r\nexpires: Thu, 30 Oct 2025 12:52:29 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8966f890731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":356,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2c32c62ebc5036ce3d23b75b70b4d884","sha1":"db2edf92cc69d96bcbd93c72caa24bd9cb74350d","sha256":"84d85fec9ce8322ee564b2717521e05bb6d54c256b87d0ccd3ca9201cf3056b2","sha512":"de41b951569d7c854c4edfd8f98effe8f45972b6e6bd5af7481acc938843900365a4bc3c709a5ab93fd27b407860434d98b87f480ecc1b2b29e47f4501cb7232","ssdeep":"","tlshash":"63e02690e4fc660c6a0906e83fbeb5d565b3335c22ca02cdb4502a19284d3cb7e05b9c","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.554081Z","times_seen":67,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ZW.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.442Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ZW.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-327\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896e8540731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":807,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"76db6ed54a43d69822a861e69eff055d","sha1":"4431bde54313ffc88718d252f3d32dd2d8e19657","sha256":"fbc6570723d3f5b3369abe46df81e62bf2a4063d205d8ef1d7da14b1e1b34bac","sha512":"4f94b017c4637ef4c72041e551425d15271399e6852d6cd22bb7d872ab1dae38abfb6d069b783f275b8aee82884a24720c0935ffa9f9d2fdd91f1d611248334d","ssdeep":"","tlshash":"5c01ce61a1b977bccd4183b02e9df0d6056b71cc605423ddb9810660216cbcfe587ae8","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.00178Z","times_seen":77,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/img/drop-sports-img.8c2ecffd.png","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.356Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /img/drop-sports-img.8c2ecffd.png HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/png\r\ncontent-length: 78853\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\netag: \"68f70d0d-13405\"\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:49 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nvary: accept-encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FFG8lOiWeikQ3S3xUuMk4GHWNX5OHjUv0qdEKM6hXaUTzVI6MryPk1%2FpgkXTzp7l5IwgU2FTIW%2BDnokQU9tikmcsqhH4LONK0SlQ\"}]}\r\ncf-ray: 9991a89cdb1556a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":78853,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 430 x 442, 8-bit colormap, non-interlaced","md5":"b6e15f0496b4f8098da23a69b47f5c9b","sha1":"dacd582cf23c46c9a6b027120b57fb40876a44da","sha256":"d38522170b62daa245613edbd2b58e0c491e007acb0849a716894a739d6703f9","sha512":"a94d8eb072ee5c5ebef17fae4906853ee4ec90424c6d13e21b64d293c6f73a03ee4ea49ea61e8fa4f85ac9f00c7ed302cd4ec3ab5504439b5c87813846dd2c7c","ssdeep":"1536:s/bcZfnTb2gPA387qGxIVN8f6Uj34fBGwd0Ovj+3/vna:6KfnTTIAJ6KIf5d0ej+3na","tlshash":"4e7312aaca2d0c1853dd78eb6e9e6941b43199190e793be3e201c8b073e707c215b27d","first_seen":"2025-08-18T15:26:48.805846Z","last_seen":"2025-12-15T03:55:58.391702Z","times_seen":68,"resource_available":false,"data":null}},"time_used":669,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":667,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.614Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8602\r\ncf-ray: 9991a89e08d90731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9667\r\ncontent-disposition: inline; filename=\"SG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbd956-25c3\"\r\nexpires: Sun, 02 Nov 2025 17:37:37 GMT\r\nlast-modified: Fri, 24 Oct 2025 19:53:58 GMT\r\ncf-cache-status: HIT\r\nage: 395016\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8602,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"82655fe367c08a140b2a65707c83f138","sha1":"1a15c06b9b310fecd9cf435fd4d45c284e9d86b0","sha256":"dd52e1b3261ff71e625f1cee5e8476c1f1cb92972ae81c6020372e2cb252aa43","sha512":"b2e687e6a6c8f7539971832d069d624dbbc59ecbde57c9ac6af96e8e1129c2e28e29eb9739b0deba5c351ba5815f58a5fae9093c8a224675823707f562a109d5","ssdeep":"192:sqg8rfJrlxmXEHUgjY1dBQi9LW7seqRho6oerN8WD++vGPLbg1bY:smrJ5xtP8xQ8L+sPRnoe58z+vGPLbgu","tlshash":"5b02afe59681a4a1b3430643f0bdcbcabcc6f3aa5d65c15313115bb49c29ae17bac0e3","first_seen":"2025-10-26T04:38:29.593814Z","last_seen":"2025-11-12T06:10:45.779292Z","times_seen":59,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/DE.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/DE.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-14e\"\r\nexpires: Thu, 06 Nov 2025 07:26:33 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a895ceab0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":334,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e5476a0d42d2c69a20fa0ec8decaed25","sha1":"07f83f1293b81d803af6c043f369614806c49056","sha256":"3f6dc3fa445f3225e6ed2a1b4bcdb6b74684b5804e6bb2cb6b50aa0325b8d81a","sha512":"d9d00a4c9ff2525f255ae58c53f2e08c98aa852e152a149a039a5bef60aa0cd73b270ea4bacf5d702942583f3a25dfa1a84496ce7a378f663de240ff3fac3451","ssdeep":"","tlshash":"c0e07d95e0bd760d6a1486a41f6ff4d684e7724d52c4074df0550d24614dbcf7c0abd8","first_seen":"2023-05-25T21:07:41Z","last_seen":"2026-05-30T10:59:04.237322Z","times_seen":523,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/UG.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.345Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/UG.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-2ab\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8968fbf0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":683,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"abab7fff91573ff833850f9d8b42f1e1","sha1":"d3564d7f360c1da6b6a59a81021257f096c538c7","sha256":"4e0dd4bd3f3f16a58ec0a0b166cda5bac479eab07d49780c69ba82256146bcee","sha512":"c81628482cbb1375b49f52fde0b07a3e0a02d58771b2b4b5f516a76882e4a151759f41f6c573fe2d8794bd4da11d85dbdd6b19dc010e2f12090705c32b76ae12","ssdeep":"","tlshash":"1f01f7d9b6bc750d990142e82faeb4c2035b32ac22c506cb744445852a5ef5fad46650","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-23T22:43:38.651668Z","times_seen":71,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.366Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-157\"\r\nexpires: Thu, 06 Nov 2025 07:26:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8969fe40731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":343,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3f4a6d5a0b32d69bb017ec9d0aed3434","sha1":"df76fceb90638f22ef5f8b503e7313edab05d5c5","sha256":"6e61dc52f06e16afd5da5b099ff2f341bcc47e518075c840ff1338ecb410ce77","sha512":"648df1fb0d38d87b9e918ba82a2807f58fd8c6670804df29ebe6648c9f2f4ac65a45f3f07a0a3b32f0bd9eeab02c789bb0255bc423275775e2c6f88658ddae86","ssdeep":"","tlshash":"f2e026b6f5e8ba0cbf454b682f9db5fb05a7334c62c5039df4841901a10e3cb7a4665c","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.544183Z","times_seen":68,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/css/index.bb5f8be6.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:45.215Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /css/index.bb5f8be6.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:45 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:16 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0c-4570a\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 06:31:13 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=AhKC76tzuE2F87IN7qfM3AXj1B1azfDjhZX1pByjr1ouC9rkQH1babas%2FajuYGlleb4pC4dqbj%2Bohugz9j4SF7hwPa8d%2BABxmwY0\"}]}\r\ncf-ray: 9991a8837e1b56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":284426,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d6c9a88c365c212863067c79040ef85a","sha1":"9b8c79793b700917f5f55ef67485110549fc36d1","sha256":"12dc13987668c14ccdab437efa64dd7ca59e9f94a61157f58573bb59aee3a208","sha512":"91c3057480a4e0ed592008f5264d27a5e5e9ceb3d5b6bc6fee7bd459d0d9c90885eeac254cac8887d3de380917f4f336a8215bd02dc505b1cced7f7f5f8fea01","ssdeep":"6144:mI29mDaSxO1WgzHoF2zcfxUjFLh/bCUHCUJytCU+tCUXCUc:mI29601dH/TbzNytqtzw","tlshash":"fa547d314a06383db677c4697cc0770d6a28d113e7272bddba95562ec7cb7a312b2389","first_seen":"2025-10-14T03:46:26.79657Z","last_seen":"2025-12-09T16:29:31.003845Z","times_seen":30,"resource_available":false,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":81,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GQ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.396Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GQ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-21d\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896b80d0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":541,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3a66a4a1b1012779615b403b8aca16c4","sha1":"77791941335929dd599a477baa70207362b7cf7b","sha256":"c0e5641e7e5880a0b2ac2724e29b0c85df0e3a26aec84d06506c2aed9dce526a","sha512":"4def061ea3536c76b4e2f01d95a79987360f8c3d7cc0e3e4aac8292d097e3aa6c70938447f9d486de3abc16c42cd7c131dadcc8fbc9089204e6a06becdb3b815","ssdeep":"","tlshash":"82f0c085f9bc775c9a4a47f46f8ef0d100d371d8269413dcb4480431b12d7cfac46a58","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.574589Z","times_seen":68,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/LS.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.449Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/LS.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-1b4\"\r\nexpires: Thu, 30 Oct 2025 07:12:30 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896f8610731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":436,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"fa89864d6c4c887dbcce727bc039687b","sha1":"dd4ce1bdd2b037756e2129bad3358d2e46942cf1","sha256":"8a7915c94c93fbbeee3af90447257267391600fdbb0a5e7e614849ab7ab7f960","sha512":"01f269c9968f47da051b1230277d4a17bdd6137fb96be60a10e45c62dd1e23a5e1b41012e8e1adaa36f54e8ee4f27a5b3036518256c8460d56a1bbd07421d82f","ssdeep":"","tlshash":"e0e0558091b8b68c4e5083b81eafb9d6405b32893a8902edf8640971720d3cfa842bcd","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.137956Z","times_seen":69,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/PAS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.588Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/PAS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7708\r\ncf-ray: 9991a89df8bd0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=8582\r\ncontent-disposition: inline; filename=\"PAS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbb968-2186\"\r\nexpires: Thu, 06 Nov 2025 04:45:13 GMT\r\nlast-modified: Fri, 24 Oct 2025 17:37:44 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7708,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b14057f9ea13889acb8ec38ecf2c2247","sha1":"5f5fbeacda71b679d693ce30a7630e346c64bf21","sha256":"35c2358e2eb2f11ea60c05d76dd0d8a18160876044fb1da33f0fdbca70e7cc9d","sha512":"fe3b8930c380fbac853364d01cc7d5a57914ca3cabe5ab5c74dab4be3cbd4e1213af1809e4229a9176e98f964f8261cb60b1f147284e360ade39749597b253c6","ssdeep":"192:pMsZs1A/8OZIVtqYyitYT/PjYIwrjajEOKSg8v:2IItqitYT/PU1ywOuW","tlshash":"5bf1b094e30d7663eb8c7d89b546ed2a8692f06b854342cc1b57376442e9c9427e4347","first_seen":"2025-10-26T04:38:29.640243Z","last_seen":"2025-11-12T04:24:41.509579Z","times_seen":54,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/RSG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.591Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/RSG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10356\r\ncf-ray: 9991a89df8bf0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=12285\r\ncontent-disposition: inline; filename=\"RSG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68ff4422-2ffd\"\r\nexpires: Wed, 05 Nov 2025 19:28:25 GMT\r\nlast-modified: Mon, 27 Oct 2025 10:06:26 GMT\r\ncf-cache-status: HIT\r\nage: 398499\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":10356,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e51efaf053ddab77a1fb7d1eaf01fe70","sha1":"a9f9e75bcf0081fe7670aa38d650a9b435847008","sha256":"595b8a4a6f2758a2c6ea981da3233fdfd3ebee6ea418402c39c1e18162febb8a","sha512":"1a08de12ab2c6bc5737c41aca216c59aee3f3641748b56f6253d551716aff7f4113ba2fc57e707a72d728373e54787681cdb5134c983fdf703d1e0ba20f8cca5","ssdeep":"192:KhpE958iAzSNJFHK3E6FxloJqelZfSjuPILLyPaHAk175EDlYSM09/7a6:oE958iAzSzNUE65lelVSqPILl+99/v","tlshash":"aa22c0aa7987cc595c77344801f85d39c3eba2350bb21949f444c37140a6fdca07ada3","first_seen":"2025-10-27T20:05:51.926524Z","last_seen":"2025-11-19T04:37:15.466697Z","times_seen":50,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/PNG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.713Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/PNG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9110\r\ncf-ray: 9991a89e69590731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9943\r\ncontent-disposition: inline; filename=\"PNG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68ea9629-26d7\"\r\nexpires: Thu, 30 Oct 2025 08:30:44 GMT\r\nlast-modified: Sat, 11 Oct 2025 17:38:49 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9110,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"edf6fef296d4d4037e0262544d2eab6c","sha1":"148a9b34d16dda6b0fe2826f9410e3e7208844b2","sha256":"ff4566a058bf817e4b59db0ee91450465290b3193d2eabf96d24e9c2e231cc88","sha512":"4388bd9bea21ff03c0c9db7aec0d230babcd154f7e4c3336bc1ef7d4cbdf40834c31c99ed27be63594fc748c5b2be63e7f0a286ddf14c437f398f830c5d3afee","ssdeep":"192:nAhzGHg1OrlO9nu0AW597JzERTgskribpMaM0l7caCs:a7ol/APQHY2p31l/Z","tlshash":"c612bf1da38afce950efb0dec4193108c561993b553f1da23a4656c3c3d49b5e488ba0","first_seen":"2025-10-16T05:46:53.818202Z","last_seen":"2025-11-12T02:57:36.962934Z","times_seen":43,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ZM.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.428Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ZM.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-278\"\r\nexpires: Thu, 06 Nov 2025 10:27:21 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896e8490731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":632,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f6c0ef98ed3bbce0d3383c35217256f0","sha1":"47e016faecd78d660d2d4aab61f8ad7b52d86560","sha256":"012e8b55228a24697e30b2c24ce98c409363c867d9c9875acfcf26f27da3205f","sha512":"5929e3e4a334afcefffc5b2583bd3a182ab9c35e41434a86eba1d8036df000cf672540b0c57ab3106a980ba95f37f5c2511a6ba355eddbc3d58524f7c13c86d4","ssdeep":"","tlshash":"0ff02686e6be771ddea743b09b6c70e0055b2284799502aca9e81030309c3ced8ab668","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.234014Z","times_seen":76,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/GB9-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.777Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/GB9-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 30560\r\ncf-ray: 9991a89ed9ea0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=32393\r\ncontent-disposition: inline; filename=\"GB9-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fdec03-7e89\"\r\nexpires: Wed, 05 Nov 2025 09:09:32 GMT\r\nlast-modified: Sun, 26 Oct 2025 09:38:11 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":30560,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5f6c6190ca428ebab35b9b527d5422de","sha1":"a08169814f23dfbcb0a0f96cb4005be8c3b20ab0","sha256":"5088e2f3deb08e955eef288aa64ba3d9237a05d41be87fa5d50c79935f185f18","sha512":"791206563dae007d25e8f9df0b667b9575f4b9243ac5b913ca7a41d7410c61fc9d16e5af5e223641475dba0e3c3df094535e13a1506c926b8b3b86d43541ff44","ssdeep":"768:GjtTZ3iVnLHKBR303vVbgQzg2IcnaWzP11pSJ:GjtTZ3iVgN03v6Q0Y51G","tlshash":"dad2f12b8547be45ac586db9b355c0c228176e43f923effdcd769ba0f51809738a1c48","first_seen":"2025-10-16T05:46:53.071697Z","last_seen":"2025-11-20T10:07:43.561196Z","times_seen":17,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/assets/chunk/GIFT.Pam_fORI.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.009Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/promo-ui/assets/chunk/GIFT.Pam_fORI.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/common/promo-ui/assets/entry/main.Bgvu34dG.js\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 03 Nov 2025 07:10:43 GMT\r\nvary: accept-encoding\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZgIc8%2BCQZdNG2GgNjKYoMhy%2FKbkrSKXWNIhMkziKLRFTw8X6TuMOzWWnb39C4E4YPbWf5qiB9vUSlmJXSW1%2FXmTWzBxkZhuUy013\"}]}\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\netag: W/\"69085573-5c\"\r\ncontent-encoding: br\r\ncf-ray: 9991a8a18ce456a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":92,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"6851acd306cf3dbdc40823c829d6199d","sha1":"d2925c8057e00ba1f0d23ee1b18ac0643d5711cc","sha256":"a9c33ca4ecded6e675ff76be1503ad875b9d74a750108e452f2aaee368a5ad3e","sha512":"a34c07a5f3a260523b7f7b4447a810fe69f7ac6ea820a1f428c6c4597d6ece419cc1d67b91238de5ed028b4955212911dd656c3ae4cc43721a1076880be3ba75","ssdeep":"","tlshash":"b0b0120714a5ca18482271c401789657b2094b10743515544048454237a3d2400409b0","first_seen":"2024-07-11T14:40:28Z","last_seen":"2026-05-31T04:40:23.083052Z","times_seen":2111,"resource_available":true,"data":null}},"time_used":589,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":589,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-258\"\r\nexpires: Wed, 05 Nov 2025 02:28:48 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8959e800731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":600,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ab522741021a33c88f45a1d2b0d9ac50","sha1":"8015dd5f4b33b368dc3d40ca9ea0498bcb63bf5d","sha256":"0147454a73c5becea1fcd88d8bd0dacb3ea54a3d99385f93b96d61e1d5288edc","sha512":"434891aa308cbd083b041450b4d49f336ccf2c3eda735adb703b4c7e4ebfe66ee74322edb9ccbeab217aa2447d8dc6f0bc0b5fec5651813b6f2195a407af32a1","ssdeep":"","tlshash":"f6f0a2e2e07cf95c6e444aa41f1fb5e660f7129847920258f4c01500344a7df3d552e5","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.118619Z","times_seen":75,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TJ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TJ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-3db\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8962f230731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":987,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6f83dc6a5c45754ec89e5ed62aea63e6","sha1":"fd92ec23aeb93fc5d07dab1f7d201d4e001663cd","sha256":"d6fe9b1878cc076dadeb2808149152e139c58c704e74c2feb18582a377bd2195","sha512":"3244ba369cbd666a4f9ff011bdc17dc01e514eb08bc27afe60cd75ecd3b626a97234bf21ca73511c06b2fabe91cc0f85194d35285fe4a57eee86fd06cdafa4c3","ssdeep":"","tlshash":"78115b62d1b4fc74e9fbc3f1d61eb6f828cf21e4528241e8b05c1650b32858dd46c985","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.157477Z","times_seen":72,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SEN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.339Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SEN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Wed, 27 Nov 2024 11:22:23 GMT\r\netag: W/\"674700ef-1c1\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8967fb40731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":449,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"21c497e852ad41952ec941687c43ebef","sha1":"102bf11f846aceba8e8a5f7fae41e3806bb14962","sha256":"eb9aad5849b2e38ef0dacd101f7861e55c8b8cd6194211e08b176ce5f8aa0468","sha512":"a32f727e26d6d28c358351d44c8b3d2ac6b9c01b0a037579b3967fd8da28db695171c87f67e0a21d786684a775f4aca2869931a8c07758b80e43144fbbe17357","ssdeep":"","tlshash":"8cf0dc94f0bd714c69090a382f9df1e7004232cc06ec028cf8801010b13d38f7887aec","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.028065Z","times_seen":67,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/decimal.min.b4a075bd.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.928Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /ac/v.1.0.1/manifest/decimal.min.b4a075bd.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 30 Oct 2025 14:59:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69037d40-32f3\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bWMzMxkkdFlD76ZzdxjO9f2Ohz%2FFuacMsMw6%2BHSoTT%2F42A0jOeotY39FGktgTzHHsutFSXAYZydnBXFxona8zB5vqmRD2StuNXDi\"}]}\r\ncf-ray: 9991a8a0ec9a56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":13043,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (12960)","md5":"b4a075bd6623180bb38318dcf2542f58","sha1":"64207af61a67ff855fd152ca4dab1532973e5db2","sha256":"25dd4d16d5fd3c4ac796badcce3ec057d92c52255f8d8481570fb54549dac5f7","sha512":"f20bc2a23070cc656266fd0b654aa6270a0864a3c413fd4ece9bd3630423266829eafc39ef7f32728c97efdc5da834e89c840409e4adc0ed53004897f01341ba","ssdeep":"192:ZusyVYg81fsu05u9gpxe5afH5NVcvqfMNlkdOYiO5PjVYCrF1FVWJK5gDArHx:wsS4OogpxcGHjcwGO5PjVrrrFcJSAArR","tlshash":"1342c5d872b1f0d683f364e040db1406e13a6e49688e61e2f34985e23cb5ec6917ffa5","first_seen":"2023-03-07T12:04:54Z","last_seen":"2026-05-31T04:40:23.164421Z","times_seen":2227,"resource_available":true,"data":null}},"time_used":558,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":558,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/@thumbmarkjs/thumbmarkjs/dist/thumbmark.umd.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.131Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/@thumbmarkjs/thumbmarkjs/dist/thumbmark.umd.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=604800, s-maxage=43200\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 1.3.3\r\nx-jsd-version-type: version\r\netag: W/\"656d-gn7cGiyzhQt+1H1p0cDKB8ucjkU\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\nage: 804\r\nx-served-by: cache-fra-eddf8230074-FRA, cache-hel1410026-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\ncontent-length: 10024\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25965,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (25853)","md5":"2d46b419f54c63207872b59ff9dad68c","sha1":"827edc1a2cb3850b7ed47d69d1c0ca07cb9c8e45","sha256":"7134e178f773638187c033f0a2247d1bf0c3fcee25918b1710331198c88ab49d","sha512":"009b4be496264deabfa25510dcc8f23a2d10170426c131132d470e5c12e398a0e1886fa4184c61ff0165bcf38e0d085786a959ed44725e9f18f97dbfb29fbfb0","ssdeep":"768:lqYkK5Hvuj2ZR62KtjqXn2bxqWGAGPCzA+Px0F3A/y95MNslps:hvMGMvgiEms8","tlshash":"2ac23ab5b2283027427b3ea7b07a810aa5356324355bc444f12d8946b6d7e8e53fbf6c","first_seen":"2025-11-02T10:02:01.647976Z","last_seen":"2025-11-19T03:51:09.886922Z","times_seen":227,"resource_available":true,"data":null}},"time_used":90,"timings":{"blocked":37,"dns":1,"connect":13,"send":0,"wait":14,"receive":1,"ssl":21},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/VN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.739Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/VN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-14f\"\r\nexpires: Thu, 06 Nov 2025 06:22:55 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 410239\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8935bbb0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":335,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4bc2a5601a76d831d6d55ea857f8b4c6","sha1":"4caa7f399af2d777e449500828765caa117d2711","sha256":"f3a13e112f1bd2cf588ace493812aeae03415e99cb7bda4fe24848f41de79315","sha512":"0b2077ee7c236b17a5f49d99e99c213bfd89580e8543d354608c4d4740cf635a085e6cbfe2367644f215b45b995be86b8eb8212a797a06af76c7e7de77082332","ssdeep":"","tlshash":"27e02656e1a89a085ea446785f2ebaea19af324c62d4038df8801813334bbdb394265d","first_seen":"2023-05-17T21:50:12Z","last_seen":"2026-05-30T13:20:41.733997Z","times_seen":303,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SZ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.453Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SZ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-393\"\r\nexpires: Thu, 06 Nov 2025 07:26:37 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896f8630731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":915,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"287333f40e1b6e6705160c45a4331253","sha1":"9ae89a94aa32497edb22278824c3b33a90b31273","sha256":"5f6bd129bf62ebb31a0fe2eccbe867f994e05e586a04dd75f8abbcd0e7ee4ceb","sha512":"7a8ffcd17d70c1a75c72067c306c6314a6313d81654a59e1d40e1d7fe8680be8d73f1770ffc0e1ddcc6256f12d868dcbfa511fc2e5f92d696d62965c62f91e76","ssdeep":"","tlshash":"17115992b0787a985d0183e4efafb4ea141731cd6a4a02fdf44115a5b22d3cf7d85ac8","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.045887Z","times_seen":71,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/R88-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.625Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/R88-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 16950\r\ncf-ray: 9991a89e18e00731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=19246\r\ncontent-disposition: inline; filename=\"R88-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd2b40-4b2e\"\r\nexpires: Wed, 05 Nov 2025 17:38:36 GMT\r\nlast-modified: Sat, 25 Oct 2025 19:55:44 GMT\r\ncf-cache-status: HIT\r\nage: 409620\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16950,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5a97f12160a95682d48527723f5945be","sha1":"827e042ed84251f1b122ca855778b71656cc9f68","sha256":"ff7eaea05f9b0931512b2de453d0dd724f5a88ec46eb5dc836989c6dd214280f","sha512":"e67dcc683d3c10f46ee81ddc81d5701c58235e8de7d87d59c4347667b2492fbad7614f93aee1777b1e207fb251140dde938644ceb8f2d05b4fcddb03ff377cc2","ssdeep":"384:FJyu2oYuRX+tqRBCaJD4GbUeYhfTArBbZFsQzyHgDTXPJ:ryuFnR8aF4/BTWvGQ+gDTB","tlshash":"9f72d171026dc06ea95226c0770dff10c45bc29a97629fe3a13f190c9a40d392edb6ce","first_seen":"2025-10-17T01:15:15.178681Z","last_seen":"2025-11-19T04:37:15.462228Z","times_seen":68,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/system/country?_=1762233590089","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.100Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/system/country?_=1762233590089 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: x3zryca502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zfjpGg8mFHVrUZy%2F%2BxKAuOv650uK3usYpAkzM4RTiPuRNh0xS5fWT47Q6dJYiBFFjnsP9DTcMLqs%2F1ardIk6mDzv5H5xRQikUTQy\"}]}\r\ncf-ray: 9991a8a21d0e56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12198,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (11319), with no line terminators","md5":"4bc56979cf95b0d8d03264cc32596f08","sha1":"3a774c1f4171a8da2d2c3a4a9b535318b21e7a70","sha256":"17e5e1a4d497697a4c3d577bd1901cd510e783328b3769fd9f11e679b135e8e4","sha512":"7c31d60cd997520a14acfebcc1afaee221c51ead21b27394f422685ae4faa9d8bdd884b635d3c8a87ad3deea3bfe6cb1ae6bd91769e7bc40c776c123071e2d21","ssdeep":"96:l6jOZwkPVnUSDUx5hxFDJxk5ViPDFthda8fTL6lkD+kavc/o9Md2aWPaCKxm5OGV:lwYRgSHwxwwV51RmT","tlshash":"8b427b3e640ddfaefd36ffd9704f362554362944d2b8240acac057727b95afd21210a8","first_seen":"2025-10-16T21:47:57.532181Z","last_seen":"2025-12-10T22:44:05.953562Z","times_seen":64,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/US.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.108Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/US.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:45 GMT\r\netag: W/\"643cf389-2d3\"\r\nexpires: Thu, 06 Nov 2025 06:17:14 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 413053\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8953dff0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":723,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a1454bbb5b13a30a70af5851b3aaa8a4","sha1":"cdc1916569d786fd6257533cfd9f37e499a382a2","sha256":"7f3012f520e4aefcff6acbb8cc7198fee604f3f806fd228f59c94077437bda82","sha512":"861016405d433d407ac6723b115ab093a010e528ab7911600d0b23afed4dc426fd56973174107eb08bcadced3859c2f5800dce8536c463fea06b0ea3d118f75d","ssdeep":"","tlshash":"3401704be7345d155edd8b94662df693547b30ca614403f930330454d34e2edf54b5b8","first_seen":"2023-05-16T13:21:28Z","last_seen":"2026-05-31T04:40:23.210992Z","times_seen":2580,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CG.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.401Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CG.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-158\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896c8160731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":344,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6344c3632f30626a6fd5d531e693370e","sha1":"2522d621914d7a3830675a38ad80fe4c13315be2","sha256":"eb08cc9989b6ed5e4aff5d2014f38fc56b99354f30f2d6738cccc4c05784c1dc","sha512":"a51995fd405bc827ce51606a9b22058134aca442f06be6cbbdb1b4ea9a06335cc60841a6e3e66f34945825647790c052caa9555d77b12b26d119db920e083a34","ssdeep":"","tlshash":"63e0269aa0a9fb0c9f0543a82f9df0d60463728e53c406acf0840918215a7df7d03b68","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.696902Z","times_seen":67,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/system/country?","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.544Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/system/country? HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: 9sbnsk6502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=16BDNkzV1NXa%2Bfe04K5qDviEffI%2FIa6Us9AYoPknTu1GnpB0jpQQ%2F1c7l%2BPSxklt3g8gsxbpyPKA8GU58cJbJnJJoTQk86Zimy4%2B\"}]}\r\ncf-ray: 9991a898688756a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12198,"size_decoded":0,"mime_type":"application/json","magic":"Unicode text, UTF-8 text, with very long lines (11319), with no line terminators","md5":"4bc56979cf95b0d8d03264cc32596f08","sha1":"3a774c1f4171a8da2d2c3a4a9b535318b21e7a70","sha256":"17e5e1a4d497697a4c3d577bd1901cd510e783328b3769fd9f11e679b135e8e4","sha512":"7c31d60cd997520a14acfebcc1afaee221c51ead21b27394f422685ae4faa9d8bdd884b635d3c8a87ad3deea3bfe6cb1ae6bd91769e7bc40c776c123071e2d21","ssdeep":"96:l6jOZwkPVnUSDUx5hxFDJxk5ViPDFthda8fTL6lkD+kavc/o9Md2aWPaCKxm5OGV:lwYRgSHwxwwV51RmT","tlshash":"8b427b3e640ddfaefd36ffd9704f362554362944d2b8240acac057727b95afd21210a8","first_seen":"2025-10-16T21:47:57.532181Z","last_seen":"2025-12-10T22:44:05.953562Z","times_seen":64,"resource_available":false,"data":null}},"time_used":200,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/OB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.266Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/OB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6900\r\ncf-ray: 9991a89c7eb00731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=7967\r\ncontent-disposition: inline; filename=\"OB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fba6d6-1f1f\"\r\nexpires: Sun, 02 Nov 2025 13:47:16 GMT\r\nlast-modified: Fri, 24 Oct 2025 16:18:30 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6900,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b46c980c3064ace2ab899f831e99ae59","sha1":"fcaa16ee89e1100d45e1eeb48b216dd17c10cbd2","sha256":"6402efd3b723614256e297a9218297cb3333b4c4ab9c1e063ad9139180f12dc7","sha512":"0cefc5494aea7e0ef80ba62e3c0457bbf083ac1408d193657bb34b03028b7b6dff7979d9c41b4267277bf12bad3476699732c3c3a6a9b4256dc0de41f748c1cf","ssdeep":"192:m5Z07Wi4DbqAGC/2p642bQBjFGIBTQ4MSN7z092:mwC/2p64E+GkTZH9zL","tlshash":"02e1aef6d619c710676e41c66bbd1704a106834e03a6f7815a81fc7359b97ee043c7b9","first_seen":"2025-10-17T01:57:49.40336Z","last_seen":"2025-11-12T02:57:36.973573Z","times_seen":36,"resource_available":false,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/TPG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.543Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/TPG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 13088\r\ncf-ray: 9991a89de88b0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=15551\r\ncontent-disposition: inline; filename=\"TPG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68eb0cd1-3cbf\"\r\nexpires: Thu, 30 Oct 2025 22:20:37 GMT\r\nlast-modified: Sun, 12 Oct 2025 02:05:05 GMT\r\ncf-cache-status: HIT\r\nage: 382087\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13088,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"74f61fe50fb4c40ea5aff270481266ef","sha1":"13bfe0b2195692703baffb22547cb12e0ca56de2","sha256":"dfd468bf3034453fe9b9f0d64b2ecc0f9c3d4fc69a4d5a93544d24433911ef2b","sha512":"758ad20cb329e40029b92dca59f4ce410e7e29eea898d7c7bb5fcf79485600a2228014f4c745e5bf754eb2a2c281b96c4abdda9001088f15d8500762f064d86c","ssdeep":"192:DgRg9B+WhK2EPFxTvKXEjsqfYGz5HDh4q/0BM2oPwI8QZV9HcHM/miPy5k:DqoGiXMz5Hh/+l5ILZ78Yqk","tlshash":"b142b0c58e4f6420ec34ef8270149dda56e1feab1404ce50d197fb65fc06a3ae289dd9","first_seen":"2025-08-01T03:46:57.4453Z","last_seen":"2025-11-04T05:20:58.508332Z","times_seen":197,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/B2C/libs/device.html?deviceId=","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.671Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/B2C/libs/device.html?deviceId= HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncontent-encoding: gzip\r\nlast-modified: Wed, 08 Jan 2025 07:43:27 GMT\r\nvary: Accept-Encoding\r\nexpires: Tue, 11 Nov 2025 05:19:47 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8934baa0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2230,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (2229)","md5":"154c496e625a34ec0f7e7570a9b4c9c8","sha1":"20cd6ed51c78134bf4d098b139034b9ef0a293b4","sha256":"bdb0a100333869e0c00638a4cdc8572f80ac5983dab83a708c600245e148f3f5","sha512":"e70faf445be6625b8fc6c72a8ebbebd4d16b2390cbe984a1dff24e993dab4d5480f40943f3369de34ca7317d7561e3fe682018bcfae34311d44a7a9c89d5291c","ssdeep":"","tlshash":"d841f3902cd0ed8587e2df7a3479f8e0e227ea8824f55e09d5419cc03e51b16ece3275","first_seen":"2025-04-08T01:11:42.652526Z","last_seen":"2025-12-09T19:06:06.201079Z","times_seen":1262,"resource_available":false,"data":null}},"time_used":325,"timings":{"blocked":56,"dns":35,"connect":1,"send":0,"wait":213,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/PP-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.296Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/PP-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11282\r\ncf-ray: 9991a89c8ec60731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=12494\r\ncontent-disposition: inline; filename=\"PP-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc2004-30ce\"\r\nexpires: Wed, 05 Nov 2025 19:13:06 GMT\r\nlast-modified: Sat, 25 Oct 2025 00:55:32 GMT\r\ncf-cache-status: HIT\r\nage: 411036\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11282,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0ecbb4e0f5e1a961a10bc8550d6804cf","sha1":"646471485771aa5f1f02abb2ca6ba6b7455e7431","sha256":"8aa6b2ae2a00de7caee4e7ae9cbc9933c3b14f917aea17ef108de91bce8224bc","sha512":"e0f0a307b2c2c7c5d9ab9f0a8ac068238a55f8eff546bbef53e5cbc1b0ada63eb896f1db0641da22ad4ea88bd35f75d8884a6b150ffeaf5d8a3e34040f7a217d","ssdeep":"192:N7mN6mSvAQXfCVIi3V1QSAmRUd+oHhYFq0f8ofEOB6+HzK8Dxe9GEcKbRz:VmYmSIQ0/QVmRirE8i6W28/Sdz","tlshash":"6632c17e2e828d47f1d56a985e27227861cdcc007b0f6ee797b1758b67801655d01193","first_seen":"2025-10-26T04:38:29.507596Z","last_seen":"2025-11-19T04:37:15.619099Z","times_seen":81,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/IMSB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/IMSB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5640\r\ncf-ray: 9991a89d0f5e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=6357\r\ncontent-disposition: inline; filename=\"IMSB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb87d7-18d5\"\r\nexpires: Wed, 05 Nov 2025 22:38:23 GMT\r\nlast-modified: Fri, 24 Oct 2025 14:06:15 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5640,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c7a6bf459a7de1f2fa5708ef1e708d3f","sha1":"44f37c402c27e5f1de7e45c0e32ef44fdfdcdaee","sha256":"9d0019b1a380a972fc63b767d94b2f7ab3908c8fdf5cd604837bdbaf19a9970e","sha512":"5150cfde754f76b9bf237a5140d9e971ee7bcb3be16d8cfeeb99cb33850a2da78cce74b3383d3d7787e8d5a137709aefd451c21651610805dcfee34bf78ad915","ssdeep":"96:/+fGFp0UjeoqSqeF3sVIsANeDaMPrhXvj5oU/v3uYDraHYh+nP6IgMBM367bL:WU0UjeoqSqTm5Ne1lXv9o2v3YyIUebL","tlshash":"f3c18ef911f944895da4d26a44a82fac0142f3c968d5fed3075ddca578138b830dc77b","first_seen":"2025-10-17T01:57:49.747943Z","last_seen":"2025-11-12T02:57:36.9231Z","times_seen":21,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SAS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.652Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SAS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 12626\r\ncf-ray: 9991a89e390b0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=15622\r\ncontent-disposition: inline; filename=\"SAS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68eb0f9a-3d06\"\r\nexpires: Fri, 31 Oct 2025 17:53:00 GMT\r\nlast-modified: Sun, 12 Oct 2025 02:16:58 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12626,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f52f16f011ebd92fd89bd042bf7a7848","sha1":"e7225562e874f4896161b81d972af749eb46e76c","sha256":"db77192d6505e8b1c64dc91f5f46e3eee697b0bf6f0d53de9a2bf898a3289481","sha512":"58499ebda75b6e54b52f479da658c9a61ed5f7df8c11437277f2a86a4f0f623e014431b2f440cc506263cfba30fe0c460cd1ee8c9bf0510ab88b03a85e7c105d","ssdeep":"192:UZPjBLbV65UtCyiTMu5MS6mmwLbuiad6Er4zfY1ORS4HBbud:4t4HyEMu5MLsCiv/fYURrHBbud","tlshash":"7e42d0fe7962081326dafd269633fa7145799792c263cc21f6b2850040799736accbfd","first_seen":"2025-07-26T15:40:58.931036Z","last_seen":"2025-11-04T05:20:58.51111Z","times_seen":127,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/ATG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.676Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/ATG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2896\r\ncf-ray: 9991a89e491c0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=3204\r\ncontent-disposition: inline; filename=\"ATG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb54d4-c84\"\r\nexpires: Sun, 02 Nov 2025 13:47:17 GMT\r\nlast-modified: Fri, 24 Oct 2025 10:28:36 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2896,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"019161b76585dfedd0c2797192feaded","sha1":"badb65c6dafe04454a29003ab21ef6e38415d5f8","sha256":"6b752b607747f8cbc79c3cb2f51bfd20206c7c26fcef1b6c51a08c507db1cbf8","sha512":"08a0a016097bd81577e13206bd1f0ea940ab41bcc0259fb02db7a43a08abb71a152c5a489079de8b38c18db7a629bf80a05c60d4ceb0ca392d46fbdd3151bbfa","ssdeep":"","tlshash":"56516d7422f04738f6649a2bb3bc0423a64015c8ca02502d486732fdf1be5f469a1f1c","first_seen":"2025-10-16T05:46:53.356439Z","last_seen":"2025-11-29T05:51:21.731341Z","times_seen":84,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/GCSGAME_getVendorEvent?_=1762233590089","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.110Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/GCSGAME_getVendorEvent?_=1762233590089 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: xuait5h502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: REWCEN3\r\nx-elapsed-time: 1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=N9z6N5e3o05l1c4LVpeV%2BzLGVhCR9XoMzYsZMzTK4%2B7lgOZXrXyhLNIOns60tBX3hyGi8Dkd4%2BaATqNmTUh0XCUH5VWIOVV9K9mP\"}]}\r\ncf-ray: 9991a8a22d1856a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4396,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"81a6f4c4f0cece0c833915a3f4023979","sha1":"2292554e71f11888672c8752861082c86c6e0d84","sha256":"3438e1be7170c4738a154abbd60a5b907bb04768c5dde4276d7d32415fa530cf","sha512":"871363dcd783d2b6b2487f9bc725926bbb20e2b4c7bc8390cfda105a65cfe418ed198bad3dc72b148e32fc7554b523a565499d212fb2b160014db8d6772b1bf2","ssdeep":"96:S2zzHMU/ErZL2znHSYlZbFYv74vrCrSrk2tr2G2zLH9JJd7e/rDr6rWrZy:SAsU/ErZLEyYHy4vrCrSrkcr2GEdJJhd","tlshash":"f391586a214a244b4b2411c8738ffd8eecfad41fcacddfd58a9d7c18d5b03aa9415788","first_seen":"2025-11-04T05:20:58.512097Z","last_seen":"2025-11-04T05:20:58.512097Z","times_seen":1,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CC.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.249Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CC.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-473\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8960efd0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1139,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1014990dcff05b48e7792292475828c5","sha1":"30b71a40afa5e95fee63ba55f9cc412d753a7acd","sha256":"1b12337416474d610e4385deb18d17e4f997e7d6503af0e109fc0d6abf0bd957","sha512":"36760d64fe305cd6386127dbc9e27202e262514343119212f2b62115f8d795df1b7c2ae28a4d99d798f34c8f75870b94e26a133dbc61bca98a2ac444e4d0cf62","ssdeep":"","tlshash":"8921b1464299413caeea07ec4a1db6f82defd07c33500318a99c09b475062e1d5adcc6","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.403819Z","times_seen":69,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TN.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.356Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TN.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-1d7\"\r\nexpires: Thu, 06 Nov 2025 04:45:12 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8969fd30731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":471,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"5c013018d4d863aa7928a5d94a16e287","sha1":"cb41020ed3d1e5891e82372316baefad1e196a64","sha256":"47e4341f01ccc8886ff24b77e70263b192ad097a2be474c82802b50a2744db0d","sha512":"d03277d4a5b1d7f468bde48eb55e69ea6af53d61ce29e7a320ade1daef6da3245ce4f760db877b6d6337e004a0157a46b4e1b2a15b9a16be0f09a0f3073a9fe1","ssdeep":"","tlshash":"09f09710e19da73c5e1486e85f6fb0e009b761cd2382036df8481931660eed7a8266cc","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-22T19:21:41.089438Z","times_seen":90,"resource_available":false,"data":null}},"time_used":19,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":19,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/common/promo-ui/assets/entry/main.Bgvu34dG.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /common/promo-ui/assets/entry/main.Bgvu34dG.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Mon, 03 Nov 2025 07:10:44 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69085574-1af2e8\"\r\nexpires: Wed, 05 Nov 2025 05:19:48 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: HIT\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8B5RfSeAQkA%2FMVsgL2BUUVvEwDZ%2Ffia51QoobrCocka7I%2BE0eXjjfOku58cjdkmtCXBUbqZQQdOGa3LNyvKwZjXms9Gu0krYpc7E\"}]}\r\ncf-ray: 9991a893fdb256a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1766120,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (616)","md5":"686d1b59c2e262f76cc5a22184105a49","sha1":"9668d26c19a6823ce966863e8882cb05d981a34b","sha256":"898523e8deec0ea0d90b95b28a1e720350c43fba3e1bceb83dbc6782fdf0043f","sha512":"baee00fa848b7439720da9ef54534e1ff5f114bb8666fea2d4f96827b964e293c37ce5df9662cee999ef2139903ccb3604a5792701940f0259deb012f8ad7731","ssdeep":"24576:d7Oc39Hw1t6yW7O4Q4s8tLFbP9NdZFgr/:d7Oc39Hw1t6yWC4Q4s8tLFbJZFgr/","tlshash":"a135f8015af65830815bf069565fd920712450071e48fe98ba2e8eb82f9d73cf6f6bec","first_seen":"2025-11-04T05:20:58.513943Z","last_seen":"2025-11-13T12:19:06.684334Z","times_seen":23,"resource_available":false,"data":null}},"time_used":556,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":556,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/PH.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/PH.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-314\"\r\nexpires: Fri, 07 Nov 2025 00:20:32 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146629\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8949d260731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":788,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ba804bbacdfd3c3b99fe06f8e70f160e","sha1":"862bfe059ef2921a840d69bac98b473bfdf08010","sha256":"25e6ebd84fb3ced1be5d6ef6c31dfbda19ab156eb85e31b3384491e06194160f","sha512":"6c415f0da157d07dc391a05d21c990b324e50c17260d4c75c0731f5bcbc5f288e0634c33cd26517c35461917200051eefc5b8b986054c92d71f6a7659408f64d","ssdeep":"","tlshash":"5901b840e5a8325cfe0a5f548f2e77f724bf312ca1c006bd6490ad44360b2cba5c4ec8","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-30T13:20:41.734623Z","times_seen":135,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SG.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.974Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SG.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-33d\"\r\nexpires: Thu, 06 Nov 2025 07:26:32 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146629\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a894cd6f0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":829,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ac975d1a1ef9f8a921c84454b401c9ef","sha1":"0ae9c875988faacc5f519605a6d0eb2903627332","sha256":"9885d0fa075819d785e2bffb9d001b53b6730c4812e259b1c93b9cd1e5f05a02","sha512":"c9b1a65f317b891a892d37093e0a838c5b0969e65319a3d83024d567c5ac2e3cbfdf4be092b9bd1b69bf3159f7e9d15b9eb6293a0b6eda045077976c2fb9dffe","ssdeep":"","tlshash":"0c01262cc2de233edf8f2754c71bb3d0865f227e6049e218503484d52326a8bd4eaec4","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-22T19:21:41.127385Z","times_seen":157,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/IT.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.151Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/IT.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-154\"\r\nexpires: Thu, 06 Nov 2025 07:26:33 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8955e2e0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":340,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ff40703386d1ce5dcb6f44732809e56f","sha1":"72184f897af3546980d263b757b3976c237600d0","sha256":"8f3ce99568a7c2e2560aa69cb825ac34a68dd483ffcb5c71a1204d52f882f45e","sha512":"838e3c46c896595b26185503170e73cf51052229e55359dbec45df845bdffecb05a3909967830086d73a91cd46e093aad03f6a13b6f91088009b13d2b63e3856","ssdeep":"","tlshash":"fee02072f1e87608bf454b642f9db1db0597334c11c5035df4c41911a10e3cb7a4565c","first_seen":"2023-05-25T21:07:41Z","last_seen":"2026-05-30T10:59:04.244759Z","times_seen":474,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/NS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/NS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8566\r\ncf-ray: 9991a89e694d0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9220\r\ncontent-disposition: inline; filename=\"NS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbaf95-2404\"\r\nexpires: Tue, 04 Nov 2025 03:34:43 GMT\r\nlast-modified: Fri, 24 Oct 2025 16:55:49 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8566,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"adf9d183bc23b9833a42f645a50c975a","sha1":"c17f58d5302de45c049bbc80b822610954d1061b","sha256":"24298101136a8d3fc6e72627764c597e3e5ce6b511e46b0b71a07b5754f29191","sha512":"1f6deb0cf1b3c7030c5af4b99cc24fc1416f964a0fef03979b63e949d816daa676227599adda6bf8df560d13653579b29940c27e7f00a0756d46361a1127e887","ssdeep":"192:d665l8My8HVzA4GTpIkz+yE9LK3R4RV2G+CufPG:dRAf8HpKTptHRit+3PG","tlshash":"2f02af60618873422f1db0c27a0535a5716b3c617b6e56ca6da3c343b786bef90644df","first_seen":"2025-10-18T11:41:56.904447Z","last_seen":"2025-11-12T04:24:41.526422Z","times_seen":63,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com/dev-images/GCS_VENDOR_EVENT_IMAGE_ICON/3705.png?t=1762227290804","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:50.376Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET /dev-images/GCS_VENDOR_EVENT_IMAGE_ICON/3705.png?t=1762227290804 HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: image/png\r\ncontent-length: 9212\r\ncf-ray: 9991a8a3d8d90731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: status=format_not_supported\r\naccess-control-allow-origin: *\r\netag: \"6909745a-23fc\"\r\nexpires: Tue, 11 Nov 2025 03:36:37 GMT\r\nlast-modified: Tue, 04 Nov 2025 03:34:50 GMT\r\ncf-cache-status: HIT\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9212,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"42f81dbe99437d806746b408393ae2cc","sha1":"1b57500873820ef15b104c60165226c99c540ed3","sha256":"31c07d9af5707b7fa48bf25f86d167e6f03b53a363db158ea70e5f9351dedc1c","sha512":"09f653654f5fd9dbe5e95c9fa5bede141c332084b2fdb7f0f578b55419fae3de06238a3cb6acdd75da7ae5c84ae5074cc2dd1282832a39a44bd6535b6c8dfb8f","ssdeep":"192:YJ3U2aQx9j0MoOtuYOdFSz5Pnp4QNX5pmDLeZ9NRnR+:YJE2p7/k/wVhXDCLmRw","tlshash":"9812c05cbc7771d99a4fa6274dac90399942cb70cad01fe21cf35b3880e5d549a92c07","first_seen":"2025-11-04T03:45:45.254978Z","last_seen":"2025-11-30T14:48:07.323579Z","times_seen":124,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay//PROMOFE_getPromoCodeEnable?","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.694Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay//PROMOFE_getPromoCodeEnable? HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-app-trace-id: 0s0ptet502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: REWCEN3\r\nx-elapsed-time: 1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=nfVBUgXJIamiZbgJkdQI%2FfEwq0AFbtvpXgUeRcuN0LD6IHkeVtfRF3i%2FLfMRHBTqEGg1YqeTQsD4xjKfyO2tqZjI2%2FsKPoopumB1\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9991a8930d2a56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":40,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"770069d5d9c9eb83e59cd64d221ad72c","sha1":"2b419437e5017b4dd1f5d064c566261175ab4120","sha256":"d873b292a305cb90a4efc68c82ae84fb75367eb177d45dd737824a52d9ce17f7","sha512":"d167de699e17587fa63fd9a79dcb1da9171f6a970ab5b7b87a05bb9fdbeba2ff0d3898d11d2cf7a512e5d9b4816faf8217b3c48663db6975d93018812ffff58e","ssdeep":"","tlshash":"8490040314101073c1035104153c7f10347c047741031055d14cd0dc7d71d0513c3c47","first_seen":"2025-08-09T04:42:20.162381Z","last_seen":"2026-05-31T03:54:46.844345Z","times_seen":1119,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MA.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.346Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MA.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-20d\"\r\nexpires: Thu, 06 Nov 2025 07:26:35 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8968fc10731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":525,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f90e3f47b004e4c1779db659b5522e13","sha1":"809b2cca555fda01a3766d7eeb348c2fe31986c8","sha256":"62c6e3fc10d773f7453dbdd27312ec8e06138e7cfe4c90bf157016a36ede4704","sha512":"b25845f6118aa7e62cbe23d0239e4f8252b5f60bfbe1ba60fad129d7fda7d23e0811c0259871e056df163db72e769f63653845851b6e2f67f19792b0ca8458c0","ssdeep":"","tlshash":"7bf0c06af0e86f059ca047e85b2db2f8245f308f31d5935de4b05841210efd55d566e9","first_seen":"2025-06-26T08:00:34.462242Z","last_seen":"2026-05-16T11:25:55.993173Z","times_seen":108,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/HC-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.578Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/HC-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11288\r\ncf-ray: 9991a89de8b70731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=13822\r\ncontent-disposition: inline; filename=\"HC-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68ea9a7b-35fe\"\r\nexpires: Thu, 30 Oct 2025 21:19:19 GMT\r\nlast-modified: Sat, 11 Oct 2025 17:57:15 GMT\r\ncf-cache-status: HIT\r\nage: 505810\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11288,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4ffe58d7c13d15afbec418c340bbe7e2","sha1":"7b045bad7bdcd4ae769626b97688e0b3f7a69717","sha256":"448b6305b5e0c66a04bc5f3183ba5ccb56d5096c0a7dfcb544609335d40739e8","sha512":"db32afd0e6851f6b4fda059ab46b536fcdaa260e26677a53fc607b8c3ec3489b1cb4b40f823ab9faf965f4e0f84e07cce764ba54f9cadda3aaf96004ec0e088c","ssdeep":"192:kUncBZ4KXkaeskAnKwldcM4jEBylcId1tWDuTrP0fI0GnWOWTs54KQCQE6RNNE:BcZ//eSRkj6ccId1YDerPcI0RDVPNO","tlshash":"d932bfafb67009e7d875e06a529905bf985aecd834c9457e4408cc0ad8ca7af41fff08","first_seen":"2025-07-26T15:40:58.823736Z","last_seen":"2025-11-04T05:20:58.518972Z","times_seen":142,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/css/chunk-web-view.fbe29057.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:45.212Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /css/chunk-web-view.fbe29057.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:45 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0d-26a02\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nexpires: Wed, 05 Nov 2025 05:19:45 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3CebBy2BdYDW5ZZ%2FqefiPUqYibayEBcPsGI8Dcz512NO8Uy0crnxwhSxorfQyfnGNDBlgK0d89i5xOtEV7ZHB93btMyQ13ImSDmz\"}]}\r\ncf-ray: 9991a8836e1956a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":158210,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"f0927e64b06b97743e2ab933232014b0","sha1":"90efae00e11db9fee6b52d5fc7f02d929440c381","sha256":"ffbdbe4e423ce82d23f479f528695e768ede569175749626b074b398901ceb86","sha512":"cf7679902eeb115ee25506e18ce00290c8c0ebd243290f06f1a2d388d5edca2b26700c3bffe20c14d039e4485c0e8e06b2495e01bdc0d0a864bf7b70acee6557","ssdeep":"3072:7rkurI/El8TzXyBon4UXkdYLLY0TyQv/fRk9TMnk+HB2xlR:7rkf/wsXyBon4UXkdYLLY0TyQv/fRk9T","tlshash":"e2f3fa269e44320cd427cd516bd8aa995039c723b17335ef7e61281ec7cbaa711e728f","first_seen":"2025-10-04T17:57:02.715579Z","last_seen":"2026-05-31T02:25:52.899415Z","times_seen":116,"resource_available":false,"data":null}},"time_used":567,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":567,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/GCSGAME_getRankList?gameCategory=ALL\u0026language=VI\u0026limitNum=20\u0026ext=avif","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.823Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/GCSGAME_getRankList?gameCategory=ALL\u0026language=VI\u0026limitNum=20\u0026ext=avif HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nLanguage: VI\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: ic2fx06502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: FREEPLAY3, COMM3\r\nx-elapsed-time: 2\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=5WCM187%2F2LJ2usUPUA1%2BluFwdUZpB7q4%2BTP6mYZayit20kSYfIL31jW%2BSPLiK2I%2BVUF%2BRZ4NwyxFbqyi4H6xqIGm8D8Z9t7zOMYN\"}]}\r\ncf-ray: 9991a89a29b556a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6185,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3ba329ff232521fd11b7d871273141e0","sha1":"11a8748cf00de6618103447820daf9421361cf50","sha256":"59d0c8a993f6bae015b1dfc62ccb5283a9f8d0c53acc50cfdf758e6a45d6af15","sha512":"78327a887912574e9dd843ec1fa45da6ec37467807bd5029c946f921bdd74d720765f3e5a791f45c9196bc1870cbe168797fd14afadd79f597e47c361fb29fdd","ssdeep":"192:9riEriBr4ecrier6riNKwror5rYrKq9rVrEuQr6Tr+:9JUTcVOIKw8t8mq9RguQ+TC","tlshash":"c5d10145a14dacef41a686a41e4efcececfee34f02c58f557a5abe184cdc67e9800059","first_seen":"2025-11-04T05:20:58.519915Z","last_seen":"2025-11-04T05:20:58.519915Z","times_seen":1,"resource_available":false,"data":null}},"time_used":199,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":199,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/VIA-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/VIA-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 21946\r\ncf-ray: 9991a89c3e420731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=23811\r\ncontent-disposition: inline; filename=\"VIA-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd6f6c-5d03\"\r\nexpires: Thu, 06 Nov 2025 06:24:25 GMT\r\nlast-modified: Sun, 26 Oct 2025 00:46:36 GMT\r\ncf-cache-status: HIT\r\nage: 352030\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":21946,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"694416ac941e166d1be0bcd91ba20896","sha1":"c4dbeefe2999ea3175c0f53c0ec63de0a2a5acae","sha256":"dfbb44ae46b5397674863e8b5b76d95f403eb59bc493e41ab1197b3feae8b5af","sha512":"73997509f7016a1db8e635becdd6c5c2bb9351624b312833b8d021b48d8289b80a1c7b8b36cdb4cbf748b4ee3fc52a27a1bd6cbbd7ae725e1e890be18320cc8e","ssdeep":"384:eJxdafJELjGl3MowDeU0SQnpCuUArJttzhaVcVpCqxqt0:eetkr0JCMttzhaVcE0","tlshash":"7fa2d064b46789908d3134902712b73d10ede8fb020eb09af9a2592c3e99e5c2de13f2","first_seen":"2025-10-17T01:15:14.995962Z","last_seen":"2025-11-19T04:37:15.6207Z","times_seen":77,"resource_available":false,"data":null}},"time_used":13,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SA-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.264Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SA-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10518\r\ncf-ray: 9991a89c6ead0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=11895\r\ncontent-disposition: inline; filename=\"SA-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc193a-2e77\"\r\nexpires: Wed, 05 Nov 2025 07:42:06 GMT\r\nlast-modified: Sat, 25 Oct 2025 00:26:34 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10518,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"fd3b99c465d5f4e518d5584b2ec4dedc","sha1":"6de0354c2ae6dcaf30c529b4084f8a27671a9a25","sha256":"2376a73cd3c803cc64d7a187aa1d0709b207815f3af31d4aa2d9aa5aadb950d2","sha512":"9e1ffb5d2a8e63508011041b337061ffd69e0ccff09db83f1dd757716b59273c728a7159810ecbcd6ea467ce62114f79822e64dc766531158cd8937ce1aa9f91","ssdeep":"192:cibFwI2OmneDomQvTaKfzST0t3GuyVBqaNstwN5/KG+zNPd0qheCjgIe:krecmBzOGDXsts5/KvcqheCs","tlshash":"f922cef30c8544381be399b151948bbd1a752e6c397ac4ff138c2ae297069bc52b179b","first_seen":"2025-10-17T01:57:50.274128Z","last_seen":"2025-11-19T04:37:15.452191Z","times_seen":59,"resource_available":false,"data":null}},"time_used":7,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":7,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/FB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.415Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/FB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5798\r\ncf-ray: 9991a89d1f7e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=6593\r\ncontent-disposition: inline; filename=\"FB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb8a91-19c1\"\r\nexpires: Thu, 06 Nov 2025 04:37:27 GMT\r\nlast-modified: Fri, 24 Oct 2025 14:17:53 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5798,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5b9239949a4adc6b18c1a97d2329ceec","sha1":"3f21d3e1f5b9c5e58fffaad315e120abead9bb59","sha256":"449b85361e4181bfb9fa99a0fbdfa811aa9b644e6b6759e8dcd157e1df8d4fe2","sha512":"ffd4fa7d3f8a237d4a39c3d6f1b718df2c86aa89f4da691956e1f10aef4b87fc778cd4d41efc6ac803276a47b13a9a9976abf1b530218e1efa977c647b9b65ce","ssdeep":"96:BBqC7rIhJb4z+875nQYTWSPSfaEHZanxXpYwvck4E6kn6eY3nsv8RqN/S/O1C:HvrIhJbaT1aSM+emR6Z3jwR1C","tlshash":"86c17d4b6070b01c009a649452def6fe47dc6a85fa32f7958b33b1edcb5a25614e7034","first_seen":"2025-10-16T05:46:54.148477Z","last_seen":"2025-11-12T02:57:36.847133Z","times_seen":51,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/index.aafb4390.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:45.210Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /js/index.aafb4390.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:45 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0d-1d4560\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 06:31:14 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qldVecE8GZLTYICb46A8BjPX5aq1wxz5TJ%2BlrDO9WO5WfIYn8xyhc07lko%2F%2FoX6IRTCxqLcmT28IUCls%2Fk%2FCPxDGOui%2F%2BNRy2F4b\"}]}\r\ncf-ray: 9991a8836e1756a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1918304,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65532), with no line terminators","md5":"020f895d5ef2aad0169a6e1b390ffb31","sha1":"42db66ac3e3f93ab6823aa3bacda384ebef506d2","sha256":"2c9ba41dacf6c531dad2af4189a3c217a7d7e0ee979e729a5ef1ac8d4d3f1438","sha512":"1c414f6c884469143c72fd090256f1781c54a09f3f1876174a46eeee887dddadbebdf704e8d287ea5ca390c8cc46db3560cda3a37efe1477a117a77bf2040eeb","ssdeep":"12288:QagaWLaK/WHln6r9U1oGpnI0S53PHt5lP3f/mKY45b0eHx:qmrVw4Ihl5Z3f/rT5b0yx","tlshash":"2f256cf6a3e8a1e49607d7f0d62aa460375f38fb7f91cdc487f88ad4966148c845acc1","first_seen":"2025-10-21T06:00:21.933402Z","last_seen":"2025-11-04T05:20:58.522185Z","times_seen":11,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NI.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.306Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NI.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-287\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8965f6b0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":647,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"704a21bf8b7aaec1f3e004ff27f8166d","sha1":"fbef9e071f79c1a8f55cc0c53598acd7738b383f","sha256":"67af38c2d27ef448d3540b5c6bfce5b38b6e549a1f7a984c48acd0e7a116e503","sha512":"8c2086876e35d215fa6e6dada4723e12c2df932b867b5e1433bc8a64cb6ef38538cccd45b7b9bba72f20382bbba1016e012985e575522d82becb1f0463896574","ssdeep":"","tlshash":"86f04e92812872dc5d42c3b89f9df0f5018b709c6099159db4491934794d7cfe94e69c","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-20T06:46:13.731188Z","times_seen":82,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GA.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.400Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GA.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-157\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896c8100731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":343,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3f4840cd3d3fb99ab3cc74a75708904c","sha1":"e5c5de3d0f92f1639c88b7bb0d4d1c46d1c43c35","sha256":"d534ace24c3c5b5e6963e2c78faa27dfdff31474a134e11be66318369205b573","sha512":"2fa6e6415a86ff6c8310028576439ed3289398ed60db0e8f108226b2b443db56aabb09952d5acfe25c8e92467d2d7b35b2628e63300212f103d48be81bc7d386","ssdeep":"","tlshash":"e4e07da5d4b97b0caf504aa46f9ef8e684d7f28c21c8038df0100d14605e7cb3d86be8","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.506408Z","times_seen":69,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SD.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.407Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SD.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-17c\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896d8270731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":380,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3aa7c54abc6030365f7aaa3066358463","sha1":"0a3831bd30a5c44c40b0f771925106116688ba4e","sha256":"bba978f8fad8da717f95017e74d701173088bbba8df2fc664c1972757c4ba2dc","sha512":"7f176250ad5a1e82f6976199e08e76aa3da7066b0dde58614bea2519b1c3721082a624ec904b28cc9fa967e859316a0f90605cd04e13c07de6c325712958933f","ssdeep":"","tlshash":"9be068c1e0f8710cae4547a86faeb0ca006732cd22d803ddf4801820b15d3cf6c02b4c","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-16T11:25:56.236873Z","times_seen":69,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/DG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.154Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/DG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 27864\r\ncf-ray: 9991a89c1e2b0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=28551\r\ncontent-disposition: inline; filename=\"DG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fdddc1-6f87\"\r\nexpires: Tue, 04 Nov 2025 20:35:56 GMT\r\nlast-modified: Sun, 26 Oct 2025 08:37:21 GMT\r\ncf-cache-status: HIT\r\nage: 309219\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":27864,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ca64448474cc7b81ac0f1efc39064798","sha1":"95ede906d3806a6d180e074df26dcf3b498f48c7","sha256":"49f28c264576b19e454dacf05c96c0d03e7efd8e2a043035f366f3a8f427b059","sha512":"a9c0407e91235dbc6614f6e48d5dec04581427c4fc0a607a850b2f75ee24a9c9d7dd9da2472ef6632f3bc2c3e7bbbc085825540d8fe774cc53e79ca049a4abc8","ssdeep":"384:Lzs8cNIGt8hg+g+WUa+DIDLyoyBLCDPvsi3sCZ29ipXsAIPEaCzflkTeQcuppxKK:Lg8pshmBLCDPJsCU9i8jCzflkyQVpZ","tlshash":"b8c2f11db8e95fdc4ab47c9e938d3411bc98f0e420d2794454ae67c4f08c15ae4bdea7","first_seen":"2025-10-24T17:40:17.812396Z","last_seen":"2025-11-19T04:37:15.483294Z","times_seen":60,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/WD-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.554Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/WD-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4834\r\ncf-ray: 9991a89de89e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=5855\r\ncontent-disposition: inline; filename=\"WD-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb779b-16df\"\r\nexpires: Wed, 05 Nov 2025 04:30:44 GMT\r\nlast-modified: Fri, 24 Oct 2025 12:56:59 GMT\r\ncf-cache-status: HIT\r\nage: 382087\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4834,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"215a8042a8074a34feca835e1001d208","sha1":"3ba815805e8b720e9fbbd8d6f46caa19a5610051","sha256":"733037c35bb20275a0f8e6998ae7645778e45d16893c3bfeec434c6dde51bb42","sha512":"4aac4f998c2d6de5d4691d1fd7fe04c9872f338cf33dc82dc9f3fef6e27318f220327c46c2d54fe85424d5cb13dbd015c379098d047741b5615327a2d030e226","ssdeep":"96:VlbdOWrVyTZVfYiS07KR2idwo5ws8nVh6pvoJsKMIO49tuub:VxMZpYPcKRxuoZkhGoeKa49tpb","tlshash":"f3a19e905762071db727e5cb73d4f881a0232dec3446f6a7a338c52cc86243ebf26945","first_seen":"2025-10-16T05:46:53.098288Z","last_seen":"2025-11-12T04:11:19.462696Z","times_seen":69,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/RLX-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.564Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/RLX-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 5924\r\ncf-ray: 9991a89de8a60731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=6727\r\ncontent-disposition: inline; filename=\"RLX-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fba226-1a47\"\r\nexpires: Thu, 06 Nov 2025 06:49:22 GMT\r\nlast-modified: Fri, 24 Oct 2025 15:58:30 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5924,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"12f148db9ac877bc146123983e0559e6","sha1":"06789041c3baa09b1f64525d7435724afb7d10ca","sha256":"4629f1e2ffbd46707a0d77fdcd36ccbf67687ba69e9dc77b3fead02a8fa2ce0f","sha512":"993ee941cb676853bde842c586fcbbc320ec2fcccf77cdce6ffb1e44e0f6edfa416f8ca4bdd60c921ac76fff51f28fb0a469e84f21010381229343cbffaa69ab","ssdeep":"96:s6gjyRRBhVEqz4l5vdJQ98PhoMhJaJKyZokMlBdyVl8IyjPfnJ0j7bE3B3lfMk8C:sDjyRRpz4j3LJbavokMFKOIyj3JmbE3P","tlshash":"bec1bfd1e51f39d900ff31609ee176bc8e4807c9fc950ecbba5aa90122a836b5900ec7","first_seen":"2025-10-17T01:15:15.713127Z","last_seen":"2025-11-12T04:24:41.541167Z","times_seen":85,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/KA-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.596Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/KA-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11250\r\ncf-ray: 9991a89df8c30731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=13124\r\ncontent-disposition: inline; filename=\"KA-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68eb1e28-3344\"\r\nexpires: Thu, 30 Oct 2025 20:33:36 GMT\r\nlast-modified: Sun, 12 Oct 2025 03:19:04 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11250,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4ab28a95ada5137bdba9acca121ecfef","sha1":"3624d131d22d4d2b46dc1bf8eea23777dcef7112","sha256":"b20b52c3b75cb14e8b2683733df373d3977f9e1a4fda1dbbab112eee1f365a74","sha512":"bf59a61a0faf909069cf76b6be12c1d46438b447d2566ddc8b79d8ac503a1877bfbd6993fa0d62a6eeff85a7737efb1a50ea781bda668064099460f7396eb50a","ssdeep":"192:TEkDpREou2hZknIe2NPuPFMzQxH1P8uY/KOxhfraxvpuqQpa5bDbF1tZv1:TEkDLEou2hZkGu6zQxJGKihzYxbRDbPt","tlshash":"5632cf8f3a0ac4ec11c7005c4ba34cade56aa12d54a94c5d9caedf724acd65ef01b816","first_seen":"2025-10-17T01:15:15.427873Z","last_seen":"2025-11-19T04:37:15.673168Z","times_seen":87,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/JP.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.932Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/JP.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:48 GMT\r\netag: W/\"643cf38c-111\"\r\nexpires: Thu, 06 Nov 2025 07:26:32 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146629\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8948d190731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":273,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"be04fd894b0d6e13a16ec1bb874b74e2","sha1":"a67efa9ef500a8d0091e3f570d133e200bf90575","sha256":"17cea0bab5029d578ee10727a9d9b93ab89720e394241ff6d59b5744d44f3d9c","sha512":"755014696d163e701ba8a7079de64c25bdb98433ef6e1c4246b143c96ca621b1e0d69aea31c31cdb81dd88b7df0565c71c1577814e5d9f4be50eab4bd2ac6e13","ssdeep":"","tlshash":"06d02ea1e0eeeb0ceb0045682f5fb1c618b7228c23c2034ef4800d12794e6c739027ec","first_seen":"2023-08-10T10:55:06Z","last_seen":"2026-05-27T05:04:05.942421Z","times_seen":331,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BW.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.451Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BW.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-18e\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896f8620731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":398,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9a7528b95cea43526a82c052154e60fe","sha1":"1172cad0534a65afd5fed5771b5bf0a0e60ff2d4","sha256":"5876b4030c09f8b33c9f5ab764762769e5761583327c0b2c62079dc08ce5d075","sha512":"73b35e84ff46f95f409f50aab266b73574ea8bc8ba4c61a6ad2a5c4becdb221b7d81129064759410be5e90604ff510e78219eaf3d0a7d3166366084008e99b0e","ssdeep":"","tlshash":"3be0f192c0b9222cfd5843f46f9ef0c041b3328d21c5178df4000d62704d7cb2a006e8","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-22T19:21:41.065176Z","times_seen":74,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ER.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.473Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/ER.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-243\"\r\nexpires: Thu, 06 Nov 2025 07:26:37 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a89708890731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":579,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"d7790c413c20478a2d03f83c5536fc6b","sha1":"aecb74471977bf4d05ba9e78006dfd73475be3fb","sha256":"3bad1d458a1a9b21cf1d2339715724c7357fd67ca773011c5ddb6b5d098c07af","sha512":"36ec12a9d9d6ac2c566b03b4347e342f1fdf04e39f0c840a7e06b2e0927a4157bd83f4c4d37978b7b5a740c3161649832952e6d0ad69f1a605bf3a2907d63edc","ssdeep":"","tlshash":"3ef0429593a9149c6a0543a01f5c75e1751f334e319903cdbd092c18354f7cebd46fc4","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:55.928766Z","times_seen":69,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.193Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10360\r\ncf-ray: 9991a89c4e500731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=11478\r\ncontent-disposition: inline; filename=\"BG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbf28a-2cd6\"\r\nexpires: Wed, 05 Nov 2025 09:09:31 GMT\r\nlast-modified: Fri, 24 Oct 2025 21:41:30 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10360,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"11e3096bcd840619c6d15430ef568365","sha1":"ef2c461c7ff9d08493c141d086554a19987c7449","sha256":"8b002b87167dbaf3de9a41853de0cf597059af9ca1e4d1d58ef77e56cac26cf7","sha512":"5575e00a79412285c087c2abfd9d2b192a1556f368d540edd985d997914cff3319b8719e8874f3741fda36f25c94afaed9c2a80149ade028b4f2b96883bcecbc","ssdeep":"192:rIO5gqFlVc/ETLiJwslUq/2SNf5xM16j3nbVux4Vk4La39GplbZXHvq4ERpMDiu7:rIyFlVgEniBlD3xKM3bwx4Vk2lFXCzMl","tlshash":"6022b0df52cce99ff5b0fc65e20a500c0aee9e7496934326e51903d9425c077b9e498d","first_seen":"2025-10-27T02:34:08.593514Z","last_seen":"2025-11-19T04:37:15.4705Z","times_seen":29,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SPB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.647Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SPB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6960\r\ncf-ray: 9991a89e28fa0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=8314\r\ncontent-disposition: inline; filename=\"SPB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbac3e-207a\"\r\nexpires: Wed, 05 Nov 2025 20:01:22 GMT\r\nlast-modified: Fri, 24 Oct 2025 16:41:34 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6960,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9839f06fe2f656fec80986e31832378b","sha1":"89a33771535065ab3fb2d51e0969cf5debc384fd","sha256":"c4882eda9db5c76e6971c8ed024275abeedad57aacc56def26a99096374434c5","sha512":"c21798eec3a163ac6c7ee876857dfcef2be5a4b3ffc4c370caa6b59f6352175e4a43cc50cad69e13f453c853760dc2a12124227f4fd395eac24ddf7591c245a8","ssdeep":"96:RTKiUDOqmtd86CmfTFrfvX8mQT2ASYbfluUfZSEHD3XaA2GTkDNoDxGesK3ka/:l9UDMj86fjuL7oUfVD3qAnkBoDDD/","tlshash":"ede1bfd71ca7d3c41b8bc627a3349cf492f9f4b8e83ea14d052b77cb9850505665784c","first_seen":"2025-10-17T01:15:15.211908Z","last_seen":"2025-11-12T04:24:41.518722Z","times_seen":89,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/DRS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/DRS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 16500\r\ncf-ray: 9991a89e694a0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=17292\r\ncontent-disposition: inline; filename=\"DRS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fcc369-438c\"\r\nexpires: Wed, 05 Nov 2025 04:51:32 GMT\r\nlast-modified: Sat, 25 Oct 2025 12:32:41 GMT\r\ncf-cache-status: HIT\r\nage: 386043\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":16500,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6158621a427dad066308805c63f2b459","sha1":"098e562912040ef2aa1e1773796a5279514de218","sha256":"dca1bef92c6e704e4e12b2a4bf73013fc5950aacb039a58f2edbdfbee4376ca1","sha512":"061ec5ed1cfa89dacecb795052deb9036c21b9a38a8209a48537db2468038f71037646b958979c0f9ff0cdb14556ae76c7443b29c9903eab0098eaf872370cac","ssdeep":"384:F9gLqXfdnqA7vMbNGWxn1r6gJvFwE0wy4tjKtuXCtlNP3lvPvKunn:F2LqXfdnqAbMbNGs1WmHY4tjKtuXInl9","tlshash":"5972d04974b1188d410f9ec97b24980060cc5f8cc63db9eba99877e59e550f27eec17a","first_seen":"2025-10-17T05:10:22.534821Z","last_seen":"2025-11-16T04:39:34.305982Z","times_seen":49,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":13,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.gstatic.com/firebasejs/9.14.0/firebase-app.js","fqdn":"www.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.74.131","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:51.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Mon, 13 Oct 2025 08:38:51 GMT","end":"Mon, 05 Jan 2026 08:38:50 GMT"},"fingerprint":{"sha1":"89:73:B0:EF:F1:BA:6A:DA:6C:2C:87:70:0D:17:11:82:30:E9:13:68","sha256":"96:8D:5D:62:3A:3A:D6:CD:06:9A:CE:52:F4:2D:91:F9:66:13:40:F4:5F:9B:88:3D:55:04:79:E3:14:96:51:FA"}}},"request":{"raw":"GET /firebasejs/9.14.0/firebase-app.js HTTP/1.1\r\nHost: www.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://www.6789.show\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups; report-to=\"firebase-js\"\r\nreport-to: {\"group\":\"firebase-js\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/firebase-js\"}]}\r\ncontent-length: 20513\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 30 Oct 2025 10:05:40 GMT\r\nexpires: Fri, 30 Oct 2026 10:05:40 GMT\r\ncache-control: public, max-age=31536000\r\nlast-modified: Thu, 10 Nov 2022 21:00:22 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nage: 414852\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":91683,"size_decoded":0,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with CRLF, LF line terminators","md5":"1133a24e73cc67fbf3a9002a2a8d2039","sha1":"08288a1be66c98dbd60f5d59b4e1b5ee23626085","sha256":"4fbb03aabc125045ee2d98be69199bcc01b9cb22aa2e438ab7422303622e0f09","sha512":"7b038fd80befe61ac54039577b161a7623cbef51f4485e6359c18d25c0d710686c2230def5ee72ea48d906292e2b76085a457c5813bdb6bd49c2d0c6d3bb6992","ssdeep":"1536:BCtUasrm5+7CClwUuDoYIt+/dpN/FZ6zeVjfPLXJpzKZyW:BCtvsrm5+7CClw5DoYIt+LN/FZ6z4jfg","tlshash":"4193a82d3bd5117206b253bc6f1ba486f72e822b2606a2d47cad83e40f7255942f5ff4","first_seen":"2023-03-09T04:10:18Z","last_seen":"2026-05-31T04:40:23.162707Z","times_seen":2309,"resource_available":true,"data":null}},"time_used":223,"timings":{"blocked":95,"dns":5,"connect":27,"send":0,"wait":22,"receive":6,"ssl":65},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/encrypt.js?v=13424","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:45.205Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /js/encrypt.js?v=13424 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:45 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0d-11982\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 06:31:13 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2YGiKAapOEy0qJjEBLxY0CSSBuco0Qg41xCtJRhRw9eSJKoByJrwpkyaize%2F19Ze03NofWkttwf2kcZRvfap7GjdwyM09s%2FOihCC\"}]}\r\ncf-ray: 9991a8836e1256a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":72066,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65458), with no line terminators","md5":"d284e0faa6d9456345ff7b0e4d57083d","sha1":"34f1aa7486dedc202617e5ebc4d70eff4710700a","sha256":"005540cc7f83afd9c9208a5911a8e31cce06e7f6b3f398099aedfda7d87b393d","sha512":"7c6da6250d871e23521588b32781873e1e774777306f32780867eb9b12619da6c2cbe310b72b3324bba5410ab4a016f300de537e27129fafbfe1a1edd49d0f40","ssdeep":"1536:AnVsmjxzHrtaDlfcg9wGxjNQ54neBFxCxCXpaKhKjWCWnWgToXzuAwZVlgpxXhdq:AG5HBASyVT0QK+5NCu+3m","tlshash":"6a63a2502ae03448c3939b79b72b34e1f42d796a78d58c4bf614bf98bf45a13ead1930","first_seen":"2025-10-21T06:00:22.212029Z","last_seen":"2025-11-04T05:20:58.530651Z","times_seen":11,"resource_available":true,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2025-11-04","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"www.6789.show/js/encrypt.js?v=13424","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AF.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.263Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/AF.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:50 GMT\r\netag: W/\"643cf38e-21f\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8962f200731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":543,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"6e52e5e9add5abdf5b36e51a9bbc3e23","sha1":"86153224bde069cc3c045072c7336cd230a21c10","sha256":"b99824b3ef2ec9405251022b891d5cee33b0cc1445b53ca3f56a961c11c707fd","sha512":"a08578b3c7b9071a13c27cc625038f2415e392f72c9cb304f9cd0245ad4a2c8d644a69057c66714b71d3458745dcf70aba084b36d9bccdc94e972bfd6a743cc5","ssdeep":"","tlshash":"41f0f625f5fa855dcb5615540efdf1810baf570931c402e775c818b1210bb96fd43659","first_seen":"2024-08-19T13:52:03.368343Z","last_seen":"2026-05-10T19:00:06.595289Z","times_seen":65,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5324242.com/wsd-images-prod/6789vndkf5/fe_setting/web_logo/wps_op1_@fix_-1__20250318141913.png","fqdn":"images.5324242.com","domain":"5324242.com","tld":"com"},"ip":{"addr":"104.18.24.208","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.719Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5324242.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 15 Sep 2025 06:54:05 GMT","end":"Sun, 14 Dec 2025 07:52:40 GMT"},"fingerprint":{"sha1":"37:B6:4A:30:D6:73:78:1E:3F:8C:E3:36:55:46:57:D1:9A:71:A0:2A","sha256":"45:35:38:03:19:81:E6:CD:04:90:43:FA:72:23:88:6C:3B:37:4D:1E:7E:F9:07:85:0F:43:B5:BB:40:C0:AD:AC"}}},"request":{"raw":"GET /wsd-images-prod/6789vndkf5/fe_setting/web_logo/wps_op1_@fix_-1__20250318141913.png HTTP/1.1\r\nHost: images.5324242.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/webp\r\ncontent-length: 99760\r\ncf-ray: 9991a8938be80731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:85,h2pri\r\ncf-polished: origFmt=png, origSize=219250\r\ncontent-disposition: inline; filename=\"wps_op1_@fix_-1__20250318141913.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"67d91062-35872\"\r\nexpires: Wed, 29 Oct 2025 05:58:07 GMT\r\nlast-modified: Tue, 18 Mar 2025 06:19:14 GMT\r\ncf-cache-status: HIT\r\nage: 588056\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=15552000\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":99760,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"1a950f4a2391b802ce44797b60a886cc","sha1":"50bac408aa66ad9e836023bf4ae87bff6fae3a4e","sha256":"9e08d712cfeab621da90a745819a069136843f6a8fa583e80e796a2092ca4dc8","sha512":"f5b1e9419fea3f993bebeeec3a41385071cefec619b37735b420fd8990c80c31632a34c71d7fd9c7ec0b072baca781e8b755e8e05c0a537a90c17b206edce58f","ssdeep":"3072:J58D+rLMR4HpCrO0oaF0YFwihycip8LItP:JO4QdzFlQtppp","tlshash":"48a3024039b88205f4ead7ea8192357590c64ec1ee7d1d8e2898f90b62331de977c57b","first_seen":"2025-08-18T15:26:48.915407Z","last_seen":"2025-12-22T04:03:13.003677Z","times_seen":59,"resource_available":false,"data":null}},"time_used":110,"timings":{"blocked":47,"dns":29,"connect":1,"send":0,"wait":12,"receive":4,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/DZ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.353Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/DZ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-1de\"\r\nexpires: Fri, 07 Nov 2025 06:05:04 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8968fca0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":478,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"300c399075a5a11f90917c766f6a8566","sha1":"12de66dbe49679fc0c3a373b823694317265ce95","sha256":"ba0d96ac2b15dcabfc0c1fca3befdabcbadd4e0087d2297d6c400b692b98621d","sha512":"0539fb1c06406d9fe8292052bc6b0a7b3c3c3197ab0b0f062ff71d0cb1485039e74de853b9d9c5b5d1bb6fe94447b80a96a8929d072d5b6b0cbde7ee7fbd1dfa","ssdeep":"","tlshash":"38f09e2592bcb32c9e104be84a7ef0a505f262dd319e036db4c82530210dba7f522acc","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-22T19:21:41.094343Z","times_seen":90,"resource_available":false,"data":null}},"time_used":12,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":12,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/RE.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.436Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/RE.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-1d6\"\r\nexpires: Fri, 31 Oct 2025 15:59:28 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896e84c0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":470,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1ffe3e405cef9bc34268edede7d5f9a4","sha1":"5b605272b81e3304ad70c82aefecdc146894b5a4","sha256":"bab9ac7d7a8803a2110f847e52b2656d0350393092cc25f0c4956a8a815048c3","sha512":"f78be0bfb648aa5ce2a8a1db9cffdc3809ea5ca801e0dd794a06c4420442e22ff8702cf74334fb0610e0605e16b7c0c57883586c47ad579923b67ed0688eb67b","ssdeep":"","tlshash":"43f02752e1bd7d4c6b2a42d09eac72e900a231cca399038d70702410624a6cfe507ad8","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-10T19:00:06.506989Z","times_seen":67,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/AMG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.708Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/AMG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8464\r\ncf-ray: 9991a89e694e0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9557\r\ncontent-disposition: inline; filename=\"AMG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbd9f6-2555\"\r\nexpires: Sun, 02 Nov 2025 17:37:53 GMT\r\nlast-modified: Fri, 24 Oct 2025 19:56:38 GMT\r\ncf-cache-status: HIT\r\nage: 388557\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8464,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"91ae41fa84a00099c67aa25e632fe79c","sha1":"e2b5328e593b7da78dbfc74fef53cad86d96c1c8","sha256":"2aa5160a676ea0d2f0cebe0125445159946b79fa9f3e2353211d5dd565d802e4","sha512":"fd50cda5cba1f24e723cc5762e967fa944c34fe18dc5b470919c1e17faea0d47badba6b9affaa194f68e32f4832ebd256facffc89a9ecd3dde21c111404d138f","ssdeep":"192:94I+Pu9xKGJfNlUSDUbLBAVLPvxop7N9JkK:9WQKGlUblA1PvEjJt","tlshash":"e702bff3fb02b69ce2c0df6fea091e9c11a1312af35a500f5672ab80a0857c17a149d7","first_seen":"2025-10-26T04:38:29.464602Z","last_seen":"2025-11-12T04:24:41.448062Z","times_seen":54,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/TCG_LOTTO_VN-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.794Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/TCG_LOTTO_VN-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8494\r\ncf-ray: 9991a89efa320731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9699\r\ncontent-disposition: inline; filename=\"TCG_LOTTO_VN-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbe5ad-25e3\"\r\nexpires: Fri, 31 Oct 2025 21:50:51 GMT\r\nlast-modified: Fri, 24 Oct 2025 20:46:37 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8494,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"927026eb562d5f2a18b4451cd4af517b","sha1":"a048d70e1d6aa6e8863bc88aef7c0378c2854c98","sha256":"4a0e7bfff028caa13278a5c001edc37a81444c3c7186284e7b48c285e3b90a00","sha512":"d8f90e6d9725f3553cb80724f44587f08cbbaf64a66c9bd7be511c7cafa13757da1a143728da5e8c3c3cdeb9ea0446dd0cbd0c50412cae6e2350bfd3ac5260ea","ssdeep":"192:YQXf+C4V60U1XlicJmdTeFKCG8wuwbvcbh9L6vNj/gp85:lP+C4V6aTeZJMgfLMJ/Q85","tlshash":"8702ae7b65a2e5a3ea3cedb1494a8ff1e2161df405ad1a4c00fcb147d7a8241ec86c5a","first_seen":"2025-10-14T07:32:51.296745Z","last_seen":"2025-11-12T02:57:36.866059Z","times_seen":40,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/GCS_merchantWallet?merchantCode=6789vndkf5","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.907Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/GCS_merchantWallet?merchantCode=6789vndkf5 HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-app-trace-id: 0dsasyj502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 2\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=cIYLSRLharwHDahRtTHu51MZteLYaCOyta5xrtGX%2FsoFIGysL4VDKB8nc%2FfP0DaW9AL0dV4F7qLwOrhB%2FSXpKUJEiOGEwHfEYCfC\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9991a8946dd956a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"ef768197e8ae1c45dd35052408dd8abb","sha1":"037b6b95dd67c056e41fb871a45401793e46810d","sha256":"b2ccf7b4106e81339a0204916f3ff80ec80e622efe2bd779cf5407dea7201ff8","sha512":"7aaba3cd36e8f27031d910a479ecca775849468118aae2ea5f9014617f1183113e78835eb31a0e4ea17bd2b16919adcf78677b1bdc5e26e7b58aab790ce8ce5b","ssdeep":"","tlshash":"6690044130000073cc03337114351f50f55c317745001044545cc0dd5dd14451043447","first_seen":"2023-07-05T17:59:29Z","last_seen":"2026-05-31T02:25:53.08346Z","times_seen":1159,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NZ.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.125Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NZ.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-3a3\"\r\nexpires: Thu, 06 Nov 2025 07:26:34 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8954e0a0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":931,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e7d2be7eedbe08c3c6f9e1fce5d9db44","sha1":"d80d6eaecbc32cde576cb32a1f789d97c7692b10","sha256":"b2af18c961a79158701d120e7e0e334dbf2709dec31010e54973a23aad3cf822","sha512":"b027cffd4a13af363318078e955b67094e362f9328f5d3a419bea1ef21ee82f8cd097db3aefafa4659814778e6358e34181cfe0a4cb4e54ac2223c4cb36dc9ff","ssdeep":"","tlshash":"9411842ad22d2949a7c842ac6dfe118132f733fb00758a6970f860a8760675ed653dc8","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-22T19:21:41.112694Z","times_seen":100,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CI.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.307Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/CI.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:49 GMT\r\netag: W/\"643cf38d-152\"\r\nexpires: Thu, 30 Oct 2025 07:22:36 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8965f6f0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":338,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f385ab70102fc72a5cc57c67549471a7","sha1":"e6c13fd6dec5441e0dc5abf097ec648fc1f95be9","sha256":"0de03bf6711094c6ce98cc89c069d452bf3848859bd36f6e3271074f6ac11b7c","sha512":"f5b73ac576f669e33e580535dd351b9c248071bb3f91074dade91f01d6b732d2944aa9c4390bc44384233da5c62f6f0e5d7b9871ab043992d86142eab2fb2b6a","ssdeep":"","tlshash":"a3e026a3e468ba4c7e0a0b746f8db4d708a7338c61ca039df8881910600e3cb794269d","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.226188Z","times_seen":86,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BI.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.421Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BI.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:50 GMT\r\netag: W/\"643cf38e-356\"\r\nexpires: Thu, 06 Nov 2025 07:26:37 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896d8380731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":854,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"761c83b881740e9c5109e0e5c6991828","sha1":"764a25c5f540ed6c9f225192875c3b84ee21677a","sha256":"b66fbf18032dce33ed03899afaeda2477f36bf169c26e4f0288d92b61b4fb6d1","sha512":"360f49a49d87b202ff8883654e6082a739ec29441fdb70708f70f1a706ece394f9478e6f07d1806e299aa0abc3f3b787405ee9310ed8967de68649002f2eefc4","ssdeep":"","tlshash":"9f01265460d4a6fc6d444be0667ab1f534efb28b63e1824df48054907c9d2dfa3cba98","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.610242Z","times_seen":69,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/YGD-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.605Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/YGD-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 4236\r\ncf-ray: 9991a89e08ce0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=5253\r\ncontent-disposition: inline; filename=\"YGD-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb6e31-1485\"\r\nexpires: Wed, 05 Nov 2025 19:08:50 GMT\r\nlast-modified: Fri, 24 Oct 2025 12:16:49 GMT\r\ncf-cache-status: HIT\r\nage: 386045\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":4236,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"7d213c0ef1fcb89f6e599498269b8741","sha1":"fa561d10b63a4aece7464729fb435f4c1459f429","sha256":"2d0fbdaeb0e302c6e1ff730925f67bb79a1a07f66251f0d3efe549ab3dc4c4b1","sha512":"1b24f24c003aa25c23493fce2371cd45c29dd30e0c4e9004d7a227e22f1fd9377dda8e6c1709c7519509977533ac538753e0d6fc4a36a5a7d010cad650a17aed","ssdeep":"96:X19zL8tHSft7eFYioITwkliUyjbx/eTrnQDiSYhwUvmccGdXAZ3y:zgSftiDTwk/yPxmPGzywUvmcHwZC","tlshash":"d6917e9ef8ba679647274c30db0fe457ce640fef53a30400ba999ba05cb0b0dd444c80","first_seen":"2025-10-13T04:41:50.484309Z","last_seen":"2025-11-12T04:24:41.652996Z","times_seen":64,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/KS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.757Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/KS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 14204\r\ncf-ray: 9991a89ea9b30731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=15938\r\ncontent-disposition: inline; filename=\"KS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc995a-3e42\"\r\nexpires: Wed, 05 Nov 2025 19:01:24 GMT\r\nlast-modified: Sat, 25 Oct 2025 09:33:14 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14204,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"9a085bfecebb830d2cd3726257740309","sha1":"830ec8af060634081c254d9552fa6fb3c2c3b622","sha256":"4179fc5ff82c83470d600b1121c824ba49f634dfdac6a5f53ab70e27c9d01ae1","sha512":"163a2702cb4d329ba7524b1b3816bab61528b8a052b8e54dfb0f261db46791ac8c9c5fedc0e0ecada4df10f343402452eda7cd1ff8ac7d4176963199ec611502","ssdeep":"384:o3al4AFTCg6bINrs1Mmg3fqILLQhp1L4LbdAk/8m3LziJ:gH46bwsKohp1kLbdF8mg","tlshash":"2552d067e31330c6b24b9e5095603a2c2b6bc312d6a3cfef593fdce96909e515184b50","first_seen":"2025-10-17T01:57:49.251786Z","last_seen":"2025-11-19T04:37:15.516504Z","times_seen":67,"resource_available":false,"data":null}},"time_used":17,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.jsdelivr.net/npm/swiper@9.3.0/swiper-bundle.min.js","fqdn":"cdn.jsdelivr.net","domain":"jsdelivr.net","tld":"net"},"ip":{"addr":"151.101.129.229","port":443,"asn":54113,"as":"FASTLY","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"jsdelivr.net","organization":""},"issuer":{"commonName":"GlobalSign Atlas R3 DV TLS CA 2025 Q2","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 02 Jun 2025 15:43:52 GMT","end":"Sat, 04 Jul 2026 15:43:51 GMT"},"fingerprint":{"sha1":"21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4","sha256":"D0:E6:8D:08:11:05:7E:0C:2A:0D:C7:E0:ED:AE:9E:18:C8:74:32:12:3D:56:43:98:62:CD:A2:08:6F:64:5B:B0"}}},"request":{"raw":"GET /npm/swiper@9.3.0/swiper-bundle.min.js HTTP/1.1\r\nHost: cdn.jsdelivr.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\ncontent-length: 39763\r\naccess-control-allow-origin: *\r\naccess-control-expose-headers: *\r\ntiming-allow-origin: *\r\ncache-control: public, max-age=31536000, s-maxage=31536000, immutable\r\ncross-origin-resource-policy: cross-origin\r\nx-content-type-options: nosniff\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\ncontent-type: application/javascript; charset=utf-8\r\nx-jsd-version: 9.3.0\r\nx-jsd-version-type: version\r\netag: W/\"221af-Y8Fk6ieasqc10zeyVaJWvuedoKk\"\r\ncontent-encoding: br\r\naccept-ranges: bytes\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\nage: 2297213\r\nx-served-by: cache-fra-etou8220046-FRA, cache-hel1410030-HEL\r\nx-cache: HIT, HIT\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\";ma=86400,h3-29=\":443\";ma=86400,h3-27=\":443\";ma=86400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":139695,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65285)","md5":"4570fef97846ca636c3c49463f861552","sha1":"63c164ea279ab2a735d337b255a256bee79da0a9","sha256":"4651353cb061bc4c99cd04687a305193ecc7d4842aabf453914a59eab46781f2","sha512":"bf569392feb91f1548af4f4ccd5e9e30ad9c7580e34bd4a5231c5b91c2a7dc8a4d316d8cf31640e50e2e929f8f4ba74c1f34cb4b1962b35543ea87003f55319a","ssdeep":"1536:EIJAfGWjLP8NE6WG/KxXzbolxU/yBkt+TSD8wkvtnTClvwSmp8Y7CjGEG5/AsVuL:HJjNi+CyBkoBUvwNp8Y7Cji5/5cp5v","tlshash":"7ad309896221b57546e316db93e4c621a3b50540b80ac8f470bd4c9f597ec9813feffa","first_seen":"2023-05-08T16:47:31Z","last_seen":"2026-05-31T04:40:23.130246Z","times_seen":2309,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":7,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/external-module.cb963217.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.926Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/external-module.cb963217.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: accept-encoding\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=zEG8Ijage%2FdzMskDjLsu87VUz%2FA1j%2BhspA1mnqCqkWSpBkRFWT6%2B5GdsKyzn1fGem66xOgtuDJMzPxXMD1VbcneM%2Bey%2BOIkCfy2M\"}]}\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\netag: W/\"69044880-1aa\"\r\ncontent-encoding: br\r\ncf-ray: 9991a8a0ec9956a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":426,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"cb9632171bda82b786fbb89531ad45f4","sha1":"1b36a6c329ac24c7adfe0e10959f04f4bb325969","sha256":"b7760263cba6848749e6cc9376f0d4dfc3485878240848a526ef56ebd804327d","sha512":"3474e573bae0212524c2a9d4f3a9f76bf7c6c558d6ce004ec307c589d18228b7cf9a51365cc778022dc8dbed81e0d8e43b5683d9f7ed23f2e12fd88a7ba8a4ba","ssdeep":"","tlshash":"e6e055ab0247e5015d32bfc7f003b161b92a1735aee8a8c2055449b297140a3f2da818","first_seen":"2023-05-26T03:36:06Z","last_seen":"2026-05-31T04:40:23.156066Z","times_seen":2203,"resource_available":true,"data":null}},"time_used":377,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":377,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TD.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.378Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/TD.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-154\"\r\nexpires: Sat, 08 Nov 2025 10:44:10 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896aff60731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":340,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a5bcfd6e4600975b44cadd15dc1cd416","sha1":"db29a97e1d393eebb9a4744f1e429122f4461d22","sha256":"a349c0055141eefb26d0ddfd7ff97637d882584bde3e9e10879e89d9e30089aa","sha512":"d0fb71f77eec74e7e446957ed429f8921ce1df4786b31eb84dc7c943adc3c32d68fb6d6ee75292c331f17139ff32ce2143ea75497755395197a10974974d60bb","ssdeep":"","tlshash":"5be026b6e1e8ba08be454b682f9df1eb05a7334c62c5039df4841901a10e3cb7a4665c","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.372334Z","times_seen":67,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/register?affiliateCode=xukqq","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-11-04T05:19:44.682Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /register?affiliateCode=xukqq HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://xukqq.6789.show/\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:45 GMT\r\ncontent-type: text/html\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0d-74a\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=OyYjZRU%2FSDwQfFMvwKayHxTVi8sU%2F3XdOyrrBkTmzokUs44ik6Xf%2F1WxlghaaYUqdc8GOaeLfngxcB8%2BCd%2Bn9qkEqL%2FgcFEGXzdf\"}]}\r\ncf-ray: 9991a8809cdf56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1866,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1848), with no line terminators","md5":"d62228c2cd130586f85c969f81e4c62c","sha1":"ec051f3f3ac99295fd302e75a760191404266aed","sha256":"290158584216584a2da420e9cff112e66eb579c89591cb071dac9015fad8d8e5","sha512":"52a8974598c620961639b67872e662cca962174f563c5bb8c9feb525c43307376dc40d3d483be4adbc9c32bf0406e4859c5a673aebc8269c1080c342612f4227","ssdeep":"","tlshash":"eb315313cd19445be160ee9cfcb0f21da58e4a5fd8a0d944b9f88b2f04a8eea0c0d740","first_seen":"2025-10-21T06:00:22.121582Z","last_seen":"2025-11-04T05:20:58.540395Z","times_seen":11,"resource_available":false,"data":null}},"time_used":442,"timings":{"blocked":50,"dns":0,"connect":0,"send":0,"wait":392,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/js/chunk-vendors.851d9129.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:45.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /js/chunk-vendors.851d9129.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:45 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Tue, 21 Oct 2025 04:33:17 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68f70d0d-1313c4\"\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\nexpires: Tue, 04 Nov 2025 05:54:10 GMT\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: HIT\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=3MoognpCt9322Ks4d9JnDWWR6yIVYmfHVNtvIOum%2FqIUms0Vtr8SoaXkqEpj7AuQ%2Btp2GiQKKiWw%2FMIWubAIIX7KF5Ck44Z6dm6k\"}]}\r\ncf-ray: 9991a8836e1656a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1250244,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (58165)","md5":"da4dcc2d55075a199ca4555be673f197","sha1":"01e1878bdf9df189cee1782e5c1b743f55e4ba12","sha256":"f2381c03b25c58054265318a1ec86e0495864720667fe44d261ff98532283d6d","sha512":"dd49e419f401f00e09f8db2a7b99668c21bbbf1588088220c810fa1930c6a2b6b57f4c96eeb7eeb46e022b9fe32d943364150fb525c30589db918fde75780f01","ssdeep":"12288:ZVcFigeWOg+YC48zg3Z9eBYyebfY+focSfs4I36WJJmhj5aoDq6ce5+b3OzXOJHu:X6e+amWV0xlRr3X5RusY","tlshash":"822517cd7292b0a307e361f5502f100bf33a5a69780e8558b665d4e6bc7e84e427bf78","first_seen":"2025-10-21T06:00:21.980548Z","last_seen":"2025-11-04T05:20:58.541012Z","times_seen":11,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/lgw/games/game_menus?prizeMode=SEA","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.538Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /lgw/games/game_menus?prizeMode=SEA HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BRckzK4%2F1NXvVCjvpcmqrKkclPaO%2FaAky%2F3IJ3YlXld4PUcqCGnkI%2F%2FLvNgYhBVf32QXpg14bCHVPaQoQ%2FbS%2F752ciSB9W77P9Og\"}]}\r\ncf-ray: 9991a898487856a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"d751713988987e9331980363e24189ce","sha1":"97d170e1550eee4afc0af065b78cda302a97674c","sha256":"4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945","sha512":"b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af","ssdeep":"","tlshash":"c7100000000000000000000000000000000003000000c0000000000000000000000000","first_seen":"2023-03-08T00:02:47Z","last_seen":"2026-05-31T05:23:38.178386Z","times_seen":284841,"resource_available":true,"data":null}},"time_used":197,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":197,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/EP-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.545Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/EP-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2470\r\ncf-ray: 9991a89de8910731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=2785\r\ncontent-disposition: inline; filename=\"EP-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb562b-ae1\"\r\nexpires: Sat, 01 Nov 2025 06:20:35 GMT\r\nlast-modified: Fri, 24 Oct 2025 10:34:19 GMT\r\ncf-cache-status: HIT\r\nage: 463671\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2470,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c5ee507e0ab1f8044b62bae450644fe6","sha1":"7aa28196b15e250046e1517102b2e55221109dba","sha256":"f366bdfac07d3c438a9774f5e470ddf66108daf2586de80fa996c94136d5cdec","sha512":"5f7be2a7f5f812331805188c312b1e16c447052bf0508e374473780600426350d0555330060bf0a5727e2f325cd46925c6a03d6c3fbafc75b148d2be7ec06e0b","ssdeep":"","tlshash":"40517d24e500e4241f7bb7765f83035072c3c154bfefc91a34b95850e5e6fa2156050d","first_seen":"2025-10-16T05:46:53.939813Z","last_seen":"2026-02-26T23:59:57.404498Z","times_seen":93,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/mc/v.1.0.1/manifest/mc_shanshan.339617ee.css","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.921Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /mc/v.1.0.1/manifest/mc_shanshan.339617ee.css HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: text/css\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Fri, 31 Oct 2025 05:26:24 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69044880-debd3\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: MISS\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2G9Swc2S0Y37klVdpfhfryLnSgA4sbfYY7riBG6GnjL1TEUbS2xRyNruI5HaRIKedPAe805ogUq8rKS9qFvhaO%2FnWFwfk5UJOjq3\"}]}\r\ncf-ray: 9991a8a0dc9656a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":912339,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"10d08aab0520c6a80666fc66fefeecd5","sha1":"02badb0e685fcd5cb7243341f963fb1a904dbece","sha256":"7bd702d0cbdf1341104c91952fc4a6642b1f97e3a54b74fe7a8ae4bff541278a","sha512":"f743c6ee91eab61d9afee1d3063aec1f26b1840935d315b4eafcd6b94ea08561d19551080ef5ef1ec98bb72b18e06496357db0c7740b64aae49a1dea0b8626a7","ssdeep":"12288:o9UkLei9gHYaKltkqOuGnx2czvBt10HWyva:o9Uuei9gHYaKltkkyNzvBQHWyS","tlshash":"e715e9359f022139b15ed83e76a4f6cd2e28c413c2572e7db246f1acc3ea7b519b1606","first_seen":"2025-10-31T11:25:46.358001Z","last_seen":"2025-11-04T05:20:58.542678Z","times_seen":24,"resource_available":false,"data":null}},"time_used":570,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":570,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/ac/v.1.0.1/manifest/numberSeparator.01b17b54.js","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /ac/v.1.0.1/manifest/numberSeparator.01b17b54.js HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785; captchaId=745eef97-164e-4244-99c9-aea79119e64f\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:50 GMT\r\ncontent-type: application/javascript\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Thu, 30 Oct 2025 14:59:12 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69037d40-526\"\r\nexpires: Wed, 05 Nov 2025 05:19:50 GMT\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncache-control: max-age=86400, public\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nedgebot-custom-cache-tier2: MISS\r\nx-frame-options: SAMEORIGIN\r\ncf-cache-status: REVALIDATED\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=JziqGF10hHmaAHcolTW7HoHy%2FPyga9xI4PAo4beo3NNnQOjo66foH7YyrSV4ZyHGIayxDsi%2Fi%2BKwPyU0Fbq7jlbP1uDf2Svofkfn\"}]}\r\ncf-ray: 9991a8a0fc9f56a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1318,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"01b17b549ad285136b8cb7ec0c7ec291","sha1":"7c721fd5c8da887f7c067a488d88f5fa538e3029","sha256":"959a2c44941d0318df9e0a3776c30393f74d50c9e46d113ea911360c49a621d5","sha512":"296a7cd6d1d6741ca17d884989669b2563ff352143111629947c93892d784738d772de8a00ea99d6c2758f13065e775ab232be33fa7020f7dc4493c2a6372db2","ssdeep":"","tlshash":"d0217d5836b700124d7fb0e98b8f52025b2126577484da8fb62cda947f02c2be2d36fd","first_seen":"2024-04-23T23:35:41Z","last_seen":"2026-05-31T04:40:23.088765Z","times_seen":2110,"resource_available":true,"data":null}},"time_used":590,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":590,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BD.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.049Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/BD.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Tue, 06 May 2025 05:04:59 GMT\r\netag: W/\"6819987b-1d6\"\r\nexpires: Thu, 06 Nov 2025 02:38:00 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 307536\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8950dc60731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":470,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"df5e01f2b21b13ad562afff2d9b93463","sha1":"27c1b49003c35424943968168003576367e6f55c","sha256":"6285f7980bea1e17606383d972911e852fa31b4402c9afdc78f1f598e7ac3924","sha512":"1077d0dbd4e699c7c18701afd13281476b90dd25dadaf7da0a59b195c6047b7db4c06879acf56f613fd0a7d4b5da5f6d6f61284c25989e6fe9d2f73c1eb5c499","ssdeep":"","tlshash":"daf027e8739cda09cb040751db0820a94266a5d6524c4560f6c5ae586e6857b5e40adc","first_seen":"2025-05-15T08:59:23.825178Z","last_seen":"2026-05-31T03:54:46.687438Z","times_seen":609,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/PK.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.175Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/PK.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:46 GMT\r\netag: W/\"643cf38a-1e8\"\r\nexpires: Sun, 02 Nov 2025 06:55:44 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 267261\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8958e6e0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":488,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"8e1b819cec9ac503c212583bcfdbbb0b","sha1":"9f4c8cee6a7aec1b7ff05c4eadc1adbd1b7a8be3","sha256":"3fb630a0aa9c79b1841bc5195a80c305e56ee6c3f24c49e1019a17f1e8d6943f","sha512":"3143148ea4cb2025753f350d54b2530bf68d1cb0d54ae6dc90bb22460cbe2ed93fc581e55baa41f32943bb70891c706801a11f795ef5c312fd2ea03fa78dc43b","ssdeep":"","tlshash":"1bf09e90d2dd621c9e25c7284f7ab0d1409b13dc2199036dfda91430720e3df79836ed","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-24T20:04:54.390081Z","times_seen":159,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/TGC-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.276Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/TGC-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 7904\r\ncf-ray: 9991a89c7eb70731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=9005\r\ncontent-disposition: inline; filename=\"TGC-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbba60-232d\"\r\nexpires: Sun, 02 Nov 2025 13:47:16 GMT\r\nlast-modified: Fri, 24 Oct 2025 17:41:52 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7904,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"342072fd9f904bbd52a32b757d7922f9","sha1":"d21e1207f943a46c647232c04a05676ae49c7c69","sha256":"7085bde5d3f44f2c1f7f071dbcbec0c9fd236774300bd351ffaf6f60dbb169cb","sha512":"1ac2f1520fc962f9463e2f48daae55ff8cb730c8c97c2a0eaec3b589af37e578cef487d19374dfd42117f5652c1c41c5b3e7d3a186f555ddf0caf9a0caf703c0","ssdeep":"192:0y0wL6jy16WGHSUkvZMVEDDpLfEp+h+ibgIfS:cEbUOZ1fEp+hXbgI6","tlshash":"a5f1affff20795a6049daa24e758a47ba71c79d614b6720f30c9d02c5384c190fafbb6","first_seen":"2025-10-16T05:46:53.656277Z","last_seen":"2025-11-12T02:57:36.945991Z","times_seen":14,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/UG2-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.372Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/UG2-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 17404\r\ncf-ray: 9991a89cef400731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=20250\r\ncontent-disposition: inline; filename=\"UG2-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fd5561-4f1a\"\r\nexpires: Wed, 05 Nov 2025 18:56:30 GMT\r\nlast-modified: Sat, 25 Oct 2025 22:55:29 GMT\r\ncf-cache-status: HIT\r\nage: 410238\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":17404,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d59267a8cac8d1dd42cb5b2363e7fc2e","sha1":"4f13ad32f4dea365caad7bce66d19c5473e57959","sha256":"a169fcff60852f2ab28d998f712ca1a804664c08c03230d854f2aead36c6921d","sha512":"e1a383383f5aafa3e5e75604075677303a1e337a6ee46ea3e966fc33c59000703778dd156d4d87f6ac3b644e7bd550e39bc4c162cd4ef586510723e5a492ed2e","ssdeep":"384:m+MzaXTa9ldq38CCoBED62dF9KGtAC/0mQm:m32G9/qQoBE22yCD","tlshash":"4872e0de09708e0fb537dab64ec2cccd30942ee92a9cf97f5808f95360204a6887302d","first_seen":"2025-10-16T05:46:53.870569Z","last_seen":"2025-11-16T08:37:12.764716Z","times_seen":74,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/L22-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/L22-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 31566\r\ncf-ray: 9991a89e08d00731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=34990\r\ncontent-disposition: inline; filename=\"L22-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fe14b3-88ae\"\r\nexpires: Wed, 05 Nov 2025 08:12:04 GMT\r\nlast-modified: Sun, 26 Oct 2025 12:31:47 GMT\r\ncf-cache-status: HIT\r\nage: 386045\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31566,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"75eeec81eb97c31960b232d6d1666e88","sha1":"c57fea974efca5090cda9e8d83aa28804ba3221b","sha256":"71c0151894d47a4bab0bbfa4567a1a23ff22797fdefc7657cebdc5c68149e68c","sha512":"1bc0a1f69161f03865549cd77a033e1b105e1d528dcabc4a34c49ae1fcb7f13aa584c020874972e9de0bb0c7575079e2fe33f394e1b1f6b37732499d057309fb","ssdeep":"768:TMLILp13cP50/qblau3/yuWABn4/Fr7ddb7qSKAQv/wR:TVMx04XauDwFrxdb70/wR","tlshash":"8ae2f18448d61b01adeb9fc313d4c1c06e9c304982d425374fdb5649675beded2c6eab","first_seen":"2025-10-16T05:46:53.517769Z","last_seen":"2025-11-22T09:42:25.152583Z","times_seen":97,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MM.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:47.979Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MM.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:47 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-1ca\"\r\nexpires: Thu, 30 Oct 2025 06:32:50 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434075\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a894cd760731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":458,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e1e9937625af45d6d6c72e0b02084123","sha1":"05dc9bc7bf5d9ad29963af7beaba797eea5bea9a","sha256":"0b2d6de96e08eb1456400c08e8eb81c0a82843c6c38b908c06f786691738a5a2","sha512":"aceca1d48c333e799c5691675d7f9411e36d6f22f02480394d0f4f0b3f0aaf3389bcea53b303be390003a89fa5e636656f7104b08648c14a77f3def8538974ce","ssdeep":"","tlshash":"c9f05c61e4e9770c5a1146f09e4ef4e65493f18c92c9078df0600515a15dbc77c4e695","first_seen":"2023-10-23T10:05:01Z","last_seen":"2026-05-30T15:53:58.049487Z","times_seen":209,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NP.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.130Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/NP.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Tue, 21 Oct 2025 11:28:31 GMT\r\netag: W/\"68f76e5f-7a1\"\r\nexpires: Thu, 30 Oct 2025 07:12:28 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 434076\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8954e0f0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1953,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"614b1f6658157ca0ba9e0d5e1cafa910","sha1":"d2950ffb047a723a0ac8261b5aaadac0bcd3bbc7","sha256":"7dab4b589fec14ac38f3016beb7de0648cf093b5266c0945cc1526cce38a761f","sha512":"8b9888bc71a7139851e1f4167cd6d46016da4c4600132bb0efeb7dced7ff23df88c437bc6da196633d75caeaf63abf9b9d76b69c23d276939f2af76360ee42d4","ssdeep":"","tlshash":"b74182e4b368edc38d5417f6cb2610c95223b476ebc84144d2c73b6c24649d5fc686ea","first_seen":"2025-10-29T15:58:58.341147Z","last_seen":"2026-05-23T09:35:46.949857Z","times_seen":41,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SH.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.467Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/SH.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 23 Jun 2025 07:35:29 GMT\r\netag: W/\"685903c1-9f3c\"\r\nexpires: Fri, 07 Nov 2025 02:22:43 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a89708770731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":40764,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"34fd04f99a29b2110a04d69f627511c5","sha1":"ff190b43ea756e57496ca3c8a37fb70144fd60e8","sha256":"c836211f8c48801b8efeb05a5444de2deec72d3ea9a49c742502d0e1db4741d5","sha512":"0f70733439504776c3eb39e53979a1fc23a23c9048548e15797fd6495f6a9a852b06cfa2a92c0a70c5f987cda5a3c731d8d5e880c0f4d777382f51445d8cd046","ssdeep":"384:uZKGZ6CSnvpPvLGjzA4zHnlni7O/6UyTwMlymQwF7npRJp+9cX/Dwz0jRaRXPQvV:3s7AKbaNCqpFDe0iWTlkyfEzAhsTt4","tlshash":"b00388174309c7dabeac1568ed58248d75a8de8bd8b4f2c0ab1b4817e09d0f4d65cbec","first_seen":"2025-08-18T15:26:48.841766Z","last_seen":"2026-05-10T19:00:06.578738Z","times_seen":64,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/CMD-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/CMD-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 25364\r\ncf-ray: 9991a89cdf330731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=27201\r\ncontent-disposition: inline; filename=\"CMD-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fdb232-6a41\"\r\nexpires: Wed, 05 Nov 2025 17:39:27 GMT\r\nlast-modified: Sun, 26 Oct 2025 05:31:30 GMT\r\ncf-cache-status: HIT\r\nage: 155935\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":25364,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"966a627838b22922fba393bbb3b119e3","sha1":"d0b815daab2151b0d635faccee990e33689cd31b","sha256":"a4097bed1bf86ab4bee87a89f6f5e6646a8c787e67795a4ea22defc261be2e82","sha512":"5bda022b734e40fd1e82b791b24169ea2fbd264749c14e71d95c126fc07795b94c4e64be18880c4c2cf473ca9d9d05ba6e7a2f9ac8224371d7c388332799ae91","ssdeep":"768:hKaRJmxg0gj6eQ/61J9Zmltbtjb4mK5jHUqsJv2W:waRJ/0MDQO96bKm2Qnz","tlshash":"efb2e1c727239eb7ee2ede53cd50dc6a9ccd5516e232706a3e9c6cc4e6da189050027b","first_seen":"2025-10-16T05:46:53.985705Z","last_seen":"2025-11-19T04:37:15.597485Z","times_seen":49,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/CG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.572Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/CG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 12740\r\ncf-ray: 9991a89de8ad0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=14286\r\ncontent-disposition: inline; filename=\"CG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fcc8c3-37ce\"\r\nexpires: Wed, 05 Nov 2025 06:00:29 GMT\r\nlast-modified: Sat, 25 Oct 2025 12:55:31 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":12740,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f251f37054229c26a036c2cd5c243c39","sha1":"bcfd53fac2b7a136f313144c17aa744af79b7197","sha256":"761577055d5f70a51ae1886e8bd691ae8021ecc70d3548940e00ee3abd5daf33","sha512":"3eeeb29393e23b5d1038945edf4d838456df6596cd172d050ad08c6ebb58c2b512b5bef6668fc6dd20090db9cb16afdf5f04318e437ad9400050417a267b189e","ssdeep":"384:qT01URJoB95/7eeWxER4xW9C7/1V60W4W85s6/:qgUi5/Khx9zL3hN1/","tlshash":"af42c08b79f0e5cad2761f8e64ccc7ca552da87cbc526f008d1eec1936265646c61847","first_seen":"2025-10-23T05:24:07.310031Z","last_seen":"2025-11-19T04:37:15.480836Z","times_seen":72,"resource_available":false,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":23,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/FS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.740Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/FS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 6014\r\ncf-ray: 9991a89e79750731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=6773\r\ncontent-disposition: inline; filename=\"FS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fb932e-1a75\"\r\nexpires: Sat, 01 Nov 2025 06:20:34 GMT\r\nlast-modified: Fri, 24 Oct 2025 14:54:38 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6014,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"0a64decbe94316bb4d3c4101f1a2c621","sha1":"c41d9dbf9776b641f5bca34e284f3df192d8cebc","sha256":"980a3dcd9b9b0fa0ec5b36bc7f7e43be5960a042ca21144c532204a1d2f2e0c6","sha512":"651731577781648f475269d60d6b4d4e2202f14eca496b60879bfacd2836ad6860dd08f84747558ec6ead1a4ddb59d4729948b58295a7f483053d93cc072daab","ssdeep":"96:jf5Wim12TRdLsT+VK1cvPsLVbna+nA1GZRdK06fQBYyXIVJ1pYrSKla0Tb+mrU:75wU3L7AV7adGZRdKLMXIVpxBMtrU","tlshash":"26c17dc146a18b3ed4792d36411c822a37d31511c3f1b4839b1ba69e309f6eb5acda53","first_seen":"2025-10-18T16:04:31.792261Z","last_seen":"2025-11-12T04:24:41.611016Z","times_seen":56,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/KP-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.780Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/KP-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 13122\r\ncf-ray: 9991a89ee9ff0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=14367\r\ncontent-disposition: inline; filename=\"KP-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fc67dc-381f\"\r\nexpires: Tue, 04 Nov 2025 20:26:01 GMT\r\nlast-modified: Sat, 25 Oct 2025 06:02:04 GMT\r\ncf-cache-status: HIT\r\nage: 352030\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13122,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"46df33402f1b2b263ca86b38fe26ffe4","sha1":"dfb87c98bf5c2d6a1fcd5c47d1c14692866947f2","sha256":"bdaba41fa932d95d2ef384f02571fccfeea49afc8c8069980dbbf279996e410b","sha512":"775334d5cf3232cc5351d92e4bdbf3a48724d8ebc5132e86651fd2127786e93cce93719a97ef369a8a0ec1c63ba69ae257505661a0105c57b9fdbe89ff13ff35","ssdeep":"192:+mkmOGQNZ5fKu7qpCUXM8HFyiTKnpkA4mMqO1tT33mWUYumiapBq6RBAJ1OsHupV:+M5Qd976HV4OARP/JmiapBq6EJcsuAjo","tlshash":"1842cf4255dfb1f58b98331ff0a2388e314dbba84119f52d727a8a5d3a2b0952a42f0c","first_seen":"2025-10-17T01:57:49.718315Z","last_seen":"2025-11-19T04:37:15.658282Z","times_seen":60,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MW.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.448Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/MW.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-1d5\"\r\nexpires: Thu, 06 Nov 2025 10:10:25 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896e85e0731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":469,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"821bfec12652e2deb9ed052774e93a50","sha1":"1e4f662c35c74d4437b6a9be839caa5cdd28b5da","sha256":"2ab1a258ccae0d59f5a02c65ce6afecefeba18309c72331861bee0abee64e680","sha512":"a2a06e9962e2d52dd8846773417d4fecc8752f07551eded626f3ded20007a991167b5ce7f4693b5d19fc4df9cc0ff23ee6d7601516003b24fe7b5d30e62b441d","ssdeep":"","tlshash":"e9f05450d0f5761d6a1147e05e5df4c554f7a08d36c8074df4512514711d7cb688e6d8","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:55.929536Z","times_seen":75,"resource_available":false,"data":null}},"time_used":11,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":11,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/MCSFE_getListAnnouncements?types=B%2CPL%2CPU%2CPR%2CH\u0026platform=W\u0026ext=avif","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.940Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/MCSFE_getListAnnouncements?types=B%2CPL%2CPU%2CPR%2CH\u0026platform=W\u0026ext=avif HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nMerchant: 6789vndkf5\r\nDevice: web\r\nLanguage: VI\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nx-app-trace-id: vs5e6bu502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: FREEPLAY3, COMM3\r\nx-elapsed-time: 19\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\ncontent-encoding: gzip\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=gNbqBMQYwQwllWiRFS9a3gW1Y3FiF8A9twTeNpfVG1zyXRA%2FCTADiUjlTaMG0%2B%2F53mIb%2BTWKHIGoNOBYrU9A4G6R8NVce1jRfAyz\"}]}\r\ncf-ray: 9991a89ada4256a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":610837,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"509c2576cdb4698334bb1e4d950fc980","sha1":"2cfb7a341f951323250150c17d752718717fd55d","sha256":"04ea1c508040fdad73e37f93f9e4144432d297cb23b15c922171762d4aba511a","sha512":"257a03a88df3889a146d30b02c5f1fa7fbca79d5b88800d6f7b04710b9c20e71bcc76d4be1c03d67bad363b1d27674dab1df8f0992c74c697b61012da696ec7f","ssdeep":"3072:isvBrTsvBrsWH7q4V3xc5pQq4V3xc5pqNMN2nCyAnCyxhgh2i6xEG/Suoi6xEG/U:Vhfhghbl2lyEOJLp8","tlshash":"51d4a52f56069135b1295fceb3c57ba3219eb509f563ab38be9fb94a43c4430d424b8c","first_seen":"2025-11-03T02:41:39.712671Z","last_seen":"2025-11-12T09:10:09.355621Z","times_seen":4,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":227,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/SV3-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.440Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/SV3-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15916\r\ncf-ray: 9991a89d3fb30731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=17221\r\ncontent-disposition: inline; filename=\"SV3-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68eb3dff-4345\"\r\nexpires: Thu, 30 Oct 2025 07:20:48 GMT\r\nlast-modified: Sun, 12 Oct 2025 05:34:55 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15916,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"5f28cfdc53f622756403415d08842b90","sha1":"4c9924ae7cfa2a20a0ae8060de790f707be22455","sha256":"0e0ea9f1fb99e6c6eccd8a02dc98706e489791a7db785d7be0e44f0159e56a31","sha512":"200e3ee416476d812ae33f631b56bf4ce04ea2b6e387a3bf119e5815f12e7e82dc19440eab3d654c6611cdbc9ac8384b17fffe115278909d98cd586c2fddb01f","ssdeep":"384:v/mMJrvk15YN/Xx18yDngBXVwP+nlSU0bvp3vzDl:nfk3YmyDCw0NMvl1","tlshash":"2962e0427eb31aee87d4a497129d3401ce36b4dcbb02e59d944a8fcd1655c48363f5c3","first_seen":"2025-10-18T11:41:57.792855Z","last_seen":"2025-11-20T10:07:43.505576Z","times_seen":46,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/CF-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.785Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/CF-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 13102\r\ncf-ray: 9991a89eea120731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=13984\r\ncontent-disposition: inline; filename=\"CF-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68eaea30-36a0\"\r\nexpires: Thu, 30 Oct 2025 10:17:39 GMT\r\nlast-modified: Sat, 11 Oct 2025 23:37:20 GMT\r\ncf-cache-status: HIT\r\nage: 434076\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13102,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c4536e819b67b760eb1babc1d3782068","sha1":"0a5e56acf35d6c22b7db6ff30e9836799dda5efd","sha256":"49a89784e990e48e82dd7db409e54c93b37bf621baca02502c0ace673c8a18a3","sha512":"b65a62c7e74b97a99cd6704bb6b4b9c0a209dcc626df37818b87874698acce35512b654353e72e4af5473998f1737fce068e9950fca2dd56245ca216d8678e94","ssdeep":"384:4/NJq6lezNRgh55YeggFEkKxMc52hhiGniA9:4FU6lmNRe5HRFEkrg2hcyT","tlshash":"5b42bffcabbde0a8631001e5a68267bd53a4f1775f1918cff451477930305857ae942c","first_seen":"2025-10-17T01:57:49.258991Z","last_seen":"2025-11-20T10:07:43.645787Z","times_seen":22,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KM.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.455Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/KM.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Mon, 17 Apr 2023 07:21:47 GMT\r\netag: W/\"643cf38b-3a0\"\r\nexpires: Fri, 07 Nov 2025 00:34:28 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a896f8660731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":928,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4a12bb178db2290729910f61273aeff7","sha1":"8ecf7fc94fc35f9071d4e22ded0f8fb8c7eab0f8","sha256":"ecfb4891bf96d240362ee7202367dbc50c64fa18bfdf7641a4bb8e3f84b9209c","sha512":"e514d59676138a251e45ec241b8900a4c39edf5bb93fab819d3862d67d08db22a8cdda149aa3f409f63fff0b96b5d05320853bfb4d4b308fa5eaed053f533554","ssdeep":"","tlshash":"e4113a79d0b8b97cad9fc3f09bacf1d0719572f9115505bdb04c025072197ce98e9942","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-16T11:25:56.219271Z","times_seen":69,"resource_available":false,"data":null}},"time_used":9,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":9,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/AB-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.286Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/AB-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 29578\r\ncf-ray: 9991a89c8ec30731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=30592\r\ncontent-disposition: inline; filename=\"AB-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fe3d6b-7780\"\r\nexpires: Wed, 05 Nov 2025 09:47:36 GMT\r\nlast-modified: Sun, 26 Oct 2025 15:25:31 GMT\r\ncf-cache-status: HIT\r\nage: 467458\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":29578,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"b9b5874750dd8bfb16b32c349062cd38","sha1":"402f7cdc3a9ea927bf9b07efd6462bd71c4fd4e7","sha256":"024f16c2b79e1422248f77763ee34227615ab0348b927f6a201e992b412a0a38","sha512":"ba8401ffbc1148b520946351c5a285bdfae0141806f3e26bd43aaed5bceb0d46aeb322a7f7d7c835015cb67b3f8630859547e4ade47164aa97d054717650ec17","ssdeep":"384:sw0Z4QgjuwdwlUJflP9xOqCnG/9tIFspX3LxEO1+2uqO2tMPuXkxabVgYZz+uCJU:HT3ftbOq0qpLxO7SZsJJfaq8PwqX","tlshash":"8fd2e1260e70d1a0c5fbc87803a0abb6918317e4dbb9d175e26cfe678b0451a4576fb8","first_seen":"2025-10-17T05:10:22.511186Z","last_seen":"2025-11-19T04:37:15.64318Z","times_seen":61,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/BSP-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.662Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/BSP-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 8076\r\ncf-ray: 9991a89e491b0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=8374\r\ncontent-disposition: inline; filename=\"BSP-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbca7e-20b6\"\r\nexpires: Wed, 05 Nov 2025 02:28:38 GMT\r\nlast-modified: Fri, 24 Oct 2025 18:50:38 GMT\r\ncf-cache-status: HIT\r\nage: 382088\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":8076,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f639bb1b1004710a8ff9e29411a12b15","sha1":"fd93be081ff9a660ad51da3f475b40097a83ee6f","sha256":"86e3e236e6d3f9a598bb8f1db3f8a0c4f278b8cecb503f32aa963e48bd0151c8","sha512":"40f7baf4f3f24c8b38534879f348fbf395b3e3fe4e56fe16b1aa9a5b9744cc30681c911e8961df352df421e7107d994b9d1f136782acd87e5b3b619369b45764","ssdeep":"192:cTuUe/wvu2xmf/DMxV3vpe7Oy3d3a+t1IPMoNCvQ8+RB:hT0ifr6cay3dK+t1IkSz","tlshash":"02f1bf6d0f430c1be65cb7a4bf07096604941cc2c4e71988cd86e656ba266ef4eed327","first_seen":"2025-10-17T01:15:15.245019Z","last_seen":"2026-03-17T07:00:36.415578Z","times_seen":120,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/YL-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/YL-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 3626\r\ncf-ray: 9991a89e59370731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=4391\r\ncontent-disposition: inline; filename=\"YL-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68e9ecda-1127\"\r\nexpires: Fri, 31 Oct 2025 00:58:57 GMT\r\nlast-modified: Sat, 11 Oct 2025 05:36:26 GMT\r\ncf-cache-status: HIT\r\nage: 386044\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":3626,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ddb7287b51cd7807578d71b5b4696b36","sha1":"2043ae4c354ef03181bb5b4325548130ccb01d19","sha256":"c5d4d4012f100bccf505934c8a476462ab1561d3933781e60dcf403718cfece3","sha512":"b8597d8f490ba1cefdc3d58f72ed1afe995c9475a15ebfb23fad4247e2d7e1cf057637b1cbbfd392141393ce8cd283b6d4f1a20ded62562e523fdcf81f4bd595","ssdeep":"","tlshash":"93715d08731346975b9a998222e44c01c44ed5ed7c57645a2c336fc9ea9be5645b0ab0","first_seen":"2025-10-17T01:15:15.311628Z","last_seen":"2025-11-12T04:24:41.63173Z","times_seen":73,"resource_available":false,"data":null}},"time_used":8,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GNB.svg","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.328Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/COUNTRY_FLAG/CIRCLE/GNB.svg HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:48 GMT\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\nlast-modified: Wed, 27 Nov 2024 11:22:23 GMT\r\netag: W/\"674700ef-1d2\"\r\nexpires: Fri, 07 Nov 2025 05:18:17 GMT\r\ncache-control: max-age=604800, public\r\naccess-control-allow-origin: *\r\ncf-cache-status: HIT\r\nage: 146630\r\nvary: Accept-Encoding\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\ncf-ray: 9991a8967f940731-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":466,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ac71ef8446359525384399df8439c59e","sha1":"056adfa9cccc53d3566799173f8a49648cf909c6","sha256":"d2a8d772e7eaef92aec05aa94c274991e08a31b95595dd21844c9710ebc8bb90","sha512":"11d3eb4a157faf6c9b9abf175dc7122a00e631dc4679644ac30a7d74c50ca0b2f06b05502206e0f020338998239ad4e98a977769a02bbcc3366aca29f93f1807","ssdeep":"","tlshash":"04f097a0a1b863681a0443f43b6db0d660a3330c21c923cdb0101a242468b8b3e446d8","first_seen":"2023-10-23T10:05:00Z","last_seen":"2026-05-10T19:00:06.359463Z","times_seen":68,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.6789.show/wps/relay/WPSCORE_checkIfAppDomain?rootDomain=6789.show","fqdn":"www.6789.show","domain":"6789.show","tld":"show"},"ip":{"addr":"104.21.13.138","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:48.897Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"6789.show","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 15 Oct 2025 07:22:05 GMT","end":"Tue, 13 Jan 2026 08:20:45 GMT"},"fingerprint":{"sha1":"AE:96:E5:BF:27:EF:F9:A6:5C:E9:44:65:3D:5D:00:D4:57:CD:6F:93","sha256":"A5:5F:57:3C:42:24:CE:92:6E:00:42:97:00:0C:5E:32:3E:86:98:89:77:0E:FD:D1:C9:C4:FD:75:6F:3F:84:43"}}},"request":{"raw":"GET /wps/relay/WPSCORE_checkIfAppDomain?rootDomain=6789.show HTTP/1.1\r\nHost: www.6789.show\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://www.6789.show/register?affiliateCode=xukqq\r\nMerchant: 6789vndkf5\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: SHELL_deviceId=dcd24318-7c04-443c-b5c8-531f9f759785\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nx-app-trace-id: fth8kas502\r\nx-robots-tag: noindex,nofollow\r\nx-module-id: COMM3\r\nx-elapsed-time: 1\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS\r\naccess-control-allow-headers: Merchant,Authorization,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type\r\nserver: cloudflare\r\ncontent-security-policy: default-src 'self' 'unsafe-inline' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; connect-src 'self' data: https: wss:; worker-src 'self' blob: https:; img-src 'self' data: blob: https:; frame-src 'self' https: kbzpay: wavepay: gcash:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';\r\nx-frame-options: SAMEORIGIN\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\nstrict-transport-security: max-age=0\r\nx-content-type-options: nosniff\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Kclv92ifbeQpEEVSgBL31T7QuUoMhhrvRDJP2MOUSvqkuwjNlkGV5%2B0kYeSSCbwQpDq5ywUMz0pqRbVOJYxveywbZ7M4Ipga9Gi6\"}]}\r\ncontent-encoding: br\r\ncf-ray: 9991a89a9a1056a4-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"3e87820a66f1829249ddd1a29f83c331","sha1":"d286adff496089234f911f647d33594b6c04da46","sha256":"6b73520ba2d5379eb9e88ea386fb92e3ac95f622eb8b719b39632bb5fafc2120","sha512":"5275dfc6d5eec79fdcd7054104224e2747bdfbe451b1779e063fdc104319f316c1d3e0e9e0aa3e979839b5339579b40ea7a60998bb557d9d89169c3e9db614b6","ssdeep":"","tlshash":"5b800002200008fbc00223002a382f0038ac00aba000a088e00c8088bea2802208388b","first_seen":"2025-08-21T08:43:15.406553Z","last_seen":"2026-05-31T04:40:23.122307Z","times_seen":1464,"resource_available":false,"data":null}},"time_used":198,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":198,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/RCG-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.313Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/RCG-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 35946\r\ncf-ray: 9991a89c9ed60731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=39597\r\ncontent-disposition: inline; filename=\"RCG-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fe538d-9aad\"\r\nexpires: Wed, 05 Nov 2025 19:01:24 GMT\r\nlast-modified: Sun, 26 Oct 2025 16:59:57 GMT\r\ncf-cache-status: HIT\r\nage: 352030\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35946,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"00af8fb5ee4401780e9a6058bd7b93fa","sha1":"d64273cf690e6a8071a7c1b81fe6b024a9ca594d","sha256":"e67b3646751f2864cb0b49eeaf7f704f9e2dec03f7ab88e0f73790d7cec92390","sha512":"4f58e92943cdd6f8d8a8472201d6e513766e9e81f2c5df222607a05fcfcc94fbce874bdcda0ae6d5fa241513458e723d4f759fb93ea67067bff4f1c00161360c","ssdeep":"768:B50AbJXpH63W7VeONS/p4UxwisLlxnmrjGq53I04A8:B5pbJXpHwW8Rp4UatBZmrD54fz","tlshash":"5ff2f1b884f9a74c1c1e2f2d10a8c51d6861ef89c9398f4d1dabaa4b184b8c68d4d75f","first_seen":"2025-10-17T01:57:49.338429Z","last_seen":"2025-11-26T02:43:42.392397Z","times_seen":73,"resource_available":false,"data":null}},"time_used":18,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":17,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.5949390294.com//TCG_PROD_IMAGES/RNG_LIST_VENDOR/OBS-COLOR.png","fqdn":"images.5949390294.com","domain":"5949390294.com","tld":"com"},"ip":{"addr":"172.66.40.194","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://www.6789.show/register?affiliateCode=xukqq","date":"2025-11-04T05:19:49.618Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"5949390294.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Wed, 29 Oct 2025 16:43:47 GMT","end":"Tue, 27 Jan 2026 17:43:44 GMT"},"fingerprint":{"sha1":"68:BB:42:07:48:61:49:0F:4E:2A:2A:A7:59:74:A6:B7:40:F2:9A:E5","sha256":"A6:EE:7A:25:16:06:A3:64:4C:F2:9B:45:12:1B:51:7F:16:BA:1E:28:F8:BB:54:AD:B4:C7:41:4E:DB:5E:34:6D"}}},"request":{"raw":"GET //TCG_PROD_IMAGES/RNG_LIST_VENDOR/OBS-COLOR.png HTTP/1.1\r\nHost: images.5949390294.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://www.6789.show/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Tue, 04 Nov 2025 05:19:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9760\r\ncf-ray: 9991a89e08db0731-OSL\r\ncache-control: max-age=604800, public\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=11113\r\ncontent-disposition: inline; filename=\"OBS-COLOR.webp\"\r\nvary: Accept\r\naccess-control-allow-origin: *\r\netag: \"68fbf855-2b69\"\r\nexpires: Wed, 05 Nov 2025 18:27:39 GMT\r\nlast-modified: Fri, 24 Oct 2025 22:06:13 GMT\r\ncf-cache-status: HIT\r\nage: 382088\r\naccept-ranges: bytes\r\nstrict-transport-security: max-age=0\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":9760,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"6baedf0bed6de89a019aebe0ee4790c4","sha1":"c9cb8340fa2c36a6d261076b8bb5d8ea882e91c6","sha256":"ffc5c7a032987c9bf79013dc409d6d083df44ef1273f222937b6d06193355bc8","sha512":"bcfb1c9b03dcb30d1de78fcd928a4fee696d9a44980b3a92fa19b0f116d97e3a956646eee6b34232f7cb95f953800b15fdf93e7bc5dfa69a94f8d4f379e6eb9c","ssdeep":"192:6vM4tLGCNDeKmKZXmlnXBk58fEFAw4rkt2pPGU3k/ChkgUu+KwG:6v/tC19E2w55FljgPOwkgf","tlshash":"ef12be04eca154613ce8f41d8d88c6e3a56cc625a56210f4f8581b6fc82b7b32b8be67","first_seen":"2025-10-18T11:41:57.602485Z","last_seen":"2025-11-12T09:10:09.436481Z","times_seen":49,"resource_available":false,"data":null}},"time_used":10,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":10,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}