{"report_id":"7471c1c6-6bb9-4a17-80ad-33a496b48047","version":6,"status":"done","tags":[],"date":"2026-01-14T15:11:35Z","url":{"schema":"https","addr":"io-canada-28.com","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":0,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"io-canada-28.com/","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"title":"加拿大28官网首页入口｜走势数据同步","dom":{"size":12069,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"56d1fd96cf2b5d33effb39e39614eda1","sha1":"1027f939db96f240ef521cb363c9be3ffb6a5df0","sha256":"6a623ec719c75d7b386746b6782ab2f76576494809cf0b3063067043b26a9be4","sha512":"34cc37fbad467acf4b40d1b5181ff9ee934fc2ca061b2a5ad654e9aea5e1a61549a2fe37262dd9720e98d1a0a0d868404c92a7f3ad0b8cb7e364cf45e4b57202","ssdeep":"192:OC0O/OZwmkPHgFkF0IXvwtNlwiwpp8kp1aCp8ahFwu4LlEa0OjFSXGPnYYsFpW/u:OHO/OZniHgFA0IXvwtyFpW2","tlshash":"244210b185f6482712b39092a969638b2fd8ea73c81b4b417bbc5be95fc3d91cc4310d","dom_hash":"domhashef7452b8cd6c007044a4976c067f7fd2","first_seen":"2026-01-14T15:11:41.788984Z","last_seen":"2026-01-14T15:11:41.788984Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"io-canada-28.com","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":0,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-18T15:11:35Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"io-canada-28.com","ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":53,"request_count":53,"received_data":6003079,"sent_data":29143,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]}]},{"fqdn":"tongji.kaiyunh5.cc","ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-07-14","domain_rank":0,"first_seen":"2025-09-22T20:25:40.959647Z","last_seen":"2026-01-09T10:40:20.854342Z","alert_count":0,"request_count":3,"received_data":69602,"sent_data":2246,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cheng88888.com","ip":{"addr":"122.10.18.4","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-07-15","domain_rank":0,"first_seen":"2025-08-31T14:29:35.029965Z","last_seen":"2026-01-09T10:40:20.235987Z","alert_count":0,"request_count":1,"received_data":3201,"sent_data":430,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/yu.php","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"a7a3b03d627d14d94a68e854afca0e38","sha1":"8954ddd88b4043c200eac7794e343fbd0cdfae07","sha256":"e8e21444a4149076011ff28c6af329f7e0110c565db65e324604f97d6e448d1f","sha512":"6d94ebbe32c426bd3fe982437677d76dc4dbd31118874a07deb353d7f4e62e98ae99981ac8ee94a73b9ec9f71fce61585b507954d1c785ea870623f05d03a80d","ssdeep":"","tlshash":"76b02b075d13cd10435400c0d671e118c034e21b9d00c8419098108866507c84c14860","size":129,"data":"","first_seen":"2025-09-25T11:40:08.614354Z","last_seen":"2026-06-06T02:24:29.588427Z","times_seen":30,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.js","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4b32d11120a738ec529e5d64979e9d10","sha1":"deedcd7014f47a999da6c19786713cd7a236040a","sha256":"1762dd6a64fcd59421610b68625258f9224a1f278159c4d99282adb631470465","sha512":"258a126ba730a9f57d0adef037bdf90f349265128ceb8d7d9e5c7754eb14751895dffb3220bc1da307021ea8c37c45b837064c89731313acf22a3245b3812452","ssdeep":"1536:ATgnSINAJrRJqerEKlFXhuXEjmbMNfwS9h2BLy1z71B8I6fJIKIQaFLa:AT+Z2fuqXYy1PGJ9d5","tlshash":"3963d8ce72c2753a4bcb6075a43f114ab27e9caa1448c4b4e62ac4f6383491d657bf7c","size":67972,"data":"","first_seen":"2025-09-25T22:45:46.07207Z","last_seen":"2026-08-11T12:50:15.207745Z","times_seen":17872,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cheng88888.com/link.js?0.9278177383576809","fqdn":"cheng88888.com","domain":"cheng88888.com","tld":"com"},"ip":{"addr":"122.10.18.4","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"c7656a07d710557fc36453a5a3177b94","sha1":"3bff2fcfda15ba1b13d0c7d818e6862553978db3","sha256":"a1faf75964265fadea64688779b0d5414f490cbe80ae87c169c4b4ad343062e4","sha512":"21c747a92f5b0e55169112329ea863ca80a12b62a617fd40b7f7d02449422798de20f3043be4414a003fac785dbcd05a7d6c509dd3e9af149fe180fb24a29f66","ssdeep":"","tlshash":"4f51eb6b55d54c44099b90341afb652c90bfb00fe89d98487e9ddb601fb302bfec62b9","size":2842,"data":"","first_seen":"2026-01-14T15:07:41.511254Z","last_seen":"2026-01-14T15:11:41.845833Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"eventHandler","is_inline":false,"md5":"e56ddbb05a974a6bc5ea44661e509a21","sha1":"448d4cb69f9441e10731b1ff4aa9dc81502589bd","sha256":"1759e8c6c2ce9c987245281cd33bb9260ce82e31b604131a5da486db89369913","sha512":"a3b2b0accbc0f18d13fc0eb6d742a5bf00a9614399e05b97b96ed0963e7d29b5868f73ef541c5f5bf8d125e7f7040d03f39cc853a52ffa2f1e2ebb7a20165242","ssdeep":"","tlshash":"7b700008080000800a002c00e000020080c2000802202008c020a8a0082c088808f800","size":21,"data":"","first_seen":"2023-04-10T22:51:51Z","last_seen":"2026-08-11T15:10:38.344744Z","times_seen":49489,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/gate.php","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"d36d4a3956121a110a96afd809592903","sha1":"fca59a09b59d11b881d51009ba6cd507d7a2a23f","sha256":"248db9d114b9231135bec02e312a79fa49f85cd6632ff627f42a5bffa61ecca9","sha512":"a4b6c743d53edaf7c02d11dcdeabb859a014242d80a51c08d22518843b09e596875a82e53bd73d7751b55ce17a53d0d972260a662d75d7e1eabbe7595494a593","ssdeep":"","tlshash":"a5412337ba5214311066924d3ab7c70875b2001f9a85e105b3dc901c6fadd6b1cf9bbc","size":1990,"data":"","first_seen":"2026-01-14T15:07:41.501206Z","last_seen":"2026-01-14T15:11:41.810037Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"dd9cc25d7d001a60a60fc9ac61579840","sha1":"d6c06612282a26ae71fa39dfa5fb0502f565f0cc","sha256":"a1aa04ea76d007d4a75807bc82aa39b75b7a228dc7079f60021b7748880ed838","sha512":"ef9aa26f63c597f70e92fee80b5bc66d62da537f4d0ba173d6ee44386916cd9a4533f20afd2f3b2421244ff8ed99bfae53b0a7c889a9f915ce40e9406e99777b","ssdeep":"","tlshash":"7ae02b1b72b1743b4cb706ebc0815bc57e0924d5640020292c78d80d07489c27d39ac7","size":383,"data":"","first_seen":"2026-01-14T15:11:41.863962Z","last_seen":"2026-01-14T15:11:41.863962Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/js/bootstrap.bundle.min.js","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"eedab82b15f948f7d9c5d14c03520b9a","sha1":"c11680fb4238391b241e1a03667dac1df4062df0","sha256":"a8a05ffebe24ecb2dcb698e67eb909bdda200fddc8a916a6cd0f159601c90efe","sha512":"fe5cd4bcef0aedaafd9fd8aefbd4a3c53ea9d5dcf4ca6411f663cc2fa025d89033d9d47720f4ad61a4ee076d9f77687d5e6e0a0dab5a7fb8331a37655f30b4f1","ssdeep":"1536:7SwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:Wwfs+SSO5q4tZwcEVYZFj","tlshash":"4b83b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","size":80871,"data":"","first_seen":"2026-01-14T15:11:41.814815Z","last_seen":"2026-01-14T15:11:41.814815Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"465c0af2dddda2428e6d4be0ecb2df29","sha1":"6e8f4205ebcaa89306a441d64b7a4fe37cbdc9d5","sha256":"5e78ca72b1dfe9cb8234a0394a44de64945626ea8f3bd65bb25bef31ec43de86","sha512":"25cba42e654c906e3915cc42d4144bb9a4a8fccaf75a45b3401c45f79d2c411ed83323fd977d441b9f3a368123a1014910674f3e2d9beef0246a66e9f3053fc8","ssdeep":"","tlshash":"18b012434d01c141854040c4e0b3e018c414b30b8550ccd1c0c4609931246c98c70260","size":96,"data":"","first_seen":"2026-01-14T15:11:41.865386Z","last_seen":"2026-01-14T15:11:41.865386Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/jiuyou.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.159Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/jiuyou.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33260\r\nlast-modified: Sun, 07 Sep 2025 09:34:56 GMT\r\netag: \"68bd51c0-81ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33260,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"c8ad931b675f5d8c537b832427535d0f","sha1":"d7a18d16c4a38f97151ad1c02b5c8fbdf3d20f76","sha256":"50bdc8a37b133205854e3d80c490b0f63e4b02837fea30067398075b7e49642d","sha512":"7c55286e0b35a724f116f030b9049857b1d4241aa98597a2e8523bb91a5491f2eb90a375fd4429c3d6ef09c839ff51e95c6efb765440fdbf29ea45b9d4acf195","ssdeep":"768:JONQcgYSNbhjgP6b3vCixS1LHWr9hx7u4ev4SID1z/oX3:INQ4SNBgP6dxS1z4vi4ev4S2zgH","tlshash":"dbe2f1017f06bc3828690d529a1e550d3246dfc61793eef5c5b8374df539724065b4c2","first_seen":"2025-09-24T09:47:29.013234Z","last_seen":"2026-05-18T18:12:32.966501Z","times_seen":23,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":202,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comtx2-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.962Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comtx2-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 172540\r\nlast-modified: Mon, 12 Jan 2026 14:30:05 GMT\r\netag: \"6965056d-2a1fc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":172540,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 759x758, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d81d5c2ecb170863b18f6da589d5aee1","sha1":"980d3a9a9f46f9f38b5e603b328e12e15f341bd9","sha256":"50fd5a427ae75237a6ec547795d9f901c306d28c74b2d3d4f13841bf3ade8ceb","sha512":"554734d0c22e2e56e0a9a3cc50514e2068a8d47c184177fca2ad243a209ab1a0028999039e9234594ea01a4b08700f883e0a42946599e6f6b963a234b62259f1","ssdeep":"3072:rJq+YwbrsLRpbtDjtSzsDwVmEQyCGto5gpe+x51hWzxF3+SXOfJv/wYHYaWlcF:N3brM7bpIz6+m/yCUoQwxR+GEWYHQlcF","tlshash":"72f323f5a91c4bcf816ac8562bb413f8bad25016fb564f3fad8294ecad9241c403c71b","first_seen":"2026-01-14T15:11:41.794432Z","last_seen":"2026-01-14T15:11:41.794432Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1734,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":527,"receive":1207,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comtx5-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.965Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comtx5-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 105848\r\nlast-modified: Mon, 12 Jan 2026 14:30:07 GMT\r\netag: \"6965056f-19d78\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":105848,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 714x712, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"a0a89be83fed4794de71be205c903e27","sha1":"547891fa66edf8b56c76da2044bad738f6000a4c","sha256":"c2f2f6ff6ae5fb9ef572b8c42f9b623ef48a1af66d4856c77c59c71f0d6787a6","sha512":"3d1bd90bf58a77ad3673f49eea8856223d7a717fb14def0db4fddde7836812d0eb64561f1023b454516a731e8cf4ae97c450850d9f933673996b8326418862bf","ssdeep":"3072:p/xHEsGrAb8UBevn19iMNuALnEh9aLmS8y:p/xHlZ2vn1QaLn9m+","tlshash":"76a3127b205c990cf77e1f1ce65e96ee0980bc25ee2b1bf208ad145c1b58b247d5bb24","first_seen":"2026-01-14T15:11:41.795482Z","last_seen":"2026-01-14T15:11:41.795482Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1626,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":524,"receive":1102,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comtx8-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.970Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comtx8-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 103748\r\nlast-modified: Mon, 12 Jan 2026 14:30:09 GMT\r\netag: \"69650571-19544\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":103748,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 610x608, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7bf5393c4e32f451b65cce6d91ec2db3","sha1":"696d57986f183a7e7d1efd5ba4a6d88346f030f7","sha256":"c471a34f9c518a756d2e3b05447f24e4d0c6e458721d3cbe61255a4a50fd5f06","sha512":"17ba8804198f7c542c8669f60c527dc501ac2cf5c4d3c677ee28aebeb4c8909ee51801dcefa302b9580ae8d4465f52d2db89ee8fe0f1b3b93258d020f32808a0","ssdeep":"3072:c1HbuN9ibkBOdcoiNkENmaFymegDKJkBR/mUeoc4Ja:cFbIibkBToiNhNmMDLY","tlshash":"89a312c932f5988738350a54189f02eb0ac93a80596d4de3666b1afcd08b5d7bcc7f97","first_seen":"2026-01-14T15:11:41.799393Z","last_seen":"2026-01-14T15:11:41.799393Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1652,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":522,"receive":1130,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/css/zhibo.css","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.944Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /iocanada28com/css/zhibo.css HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d1e-62616\"\r\nexpires: Thu, 15 Jan 2026 03:11:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":402966,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65483)","md5":"a9f38ee19271b2d15e28df2d2a02e274","sha1":"08bf0d515fd76e721b5acf37f32d544e76ce79c6","sha256":"faf1960da01b02171bc28d28b2b03a9e5bb579a4071ba7f142a7467e0cc78016","sha512":"5f98c4256fbae18508e96b11c5d5f3cd59483ceb543bbadb8aac81146d4d30950e6cea83d66693dab4e2ad0ab20f3c51e52d3722bf7ab131a8686746b6def804","ssdeep":"1536:+By1YRODkZqdC+c2NnRLRCPlzXAV8hDGcDsl6mcwm7VU/doDk02XLFa7b1f8FMHS:Ky1RRPNm722XMYUtSWEBKVN","tlshash":"9b841fb6f1f52175eb1af4df110c7a9e39e069afd0115ebdd8c3a326c4c3aa3026454a","first_seen":"2026-01-14T15:11:41.800235Z","last_seen":"2026-01-14T15:11:41.800235Z","times_seen":1,"resource_available":false,"data":null}},"time_used":544,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":544,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comrongyu3-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comrongyu3-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 180410\r\nlast-modified: Mon, 12 Jan 2026 14:30:02 GMT\r\netag: \"6965056a-2c0ba\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":180410,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 777x603, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"389e068f567e0b44bc3d6b9a426d67e7","sha1":"bb9e3f63fca090a0c180e23b1e4391c9bce2651b","sha256":"1db1fd6764efbad6d1e38f4854c0bf45ad5b80428b75b642cf4bfc3a82b6a992","sha512":"dd5f5fb532b35768953d3718b299cb35e279b88522a57cffebe5f1be43242b3822a68392ddf9702be7e39078ae33b599fdde32f9e56630ff73c75841a81973d8","ssdeep":"3072:xTIT4FwfoA7XLYZ/aZJvSJ8qIuPs2uHW2tRFINzy3dB/iOILgJ:xcs+XLfy5IuJuHWKeNz0f/iO8gJ","tlshash":"740412a4b04cdd13e5b50f2e8c96ea3a4f53e2705720486ace1b586948e237dd0ff6d6","first_seen":"2026-01-14T15:11:41.801642Z","last_seen":"2026-01-14T15:11:41.801642Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1712,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":533,"receive":1179,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/tb/iocanada28com/iocanada28comanquan4-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.974Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/tb/iocanada28com/iocanada28comanquan4-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 30820\r\nlast-modified: Mon, 12 Jan 2026 14:30:10 GMT\r\netag: \"69650572-7864\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":30820,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f6f9956db0bf712f96fc174d0e183dc3","sha1":"7eb9dd7ae569e78a95894a43bad4ec7172e01b0d","sha256":"d8b08dbc904f2a146a39cdcbc73b268bcc84e720825c3166491383076916df05","sha512":"e6315095e8feee7c1dde0fd9de039d0ef677f68d32e7ae2a73d9bb0d01db243dda3a67650bce0591230d9f431d927e01c6b141fc50021d2a672bf235286d8dae","ssdeep":"768:eHnRBFUFv93Eqwir2wm5oGIh0FD1fe66vj1s:EHEdnwirNEIS1Zys","tlshash":"48d2f2894864562ed2c5cd32273af6902bc85a9ffbc3d57573815b88d708c76a70a80d","first_seen":"2026-01-14T15:11:41.802496Z","last_seen":"2026-01-14T15:11:41.802496Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1312,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":519,"receive":793,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/ag-66.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.392Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/ag-66.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33604\r\nlast-modified: Sun, 07 Sep 2025 10:09:28 GMT\r\netag: \"68bd59d8-8344\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33604,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"e92b11204749525f981459967df19ab7","sha1":"f515e14ebfe3c0b9861f5af195ce60124a2d2982","sha256":"a841caa2ae77d709aa75182c640051f701e8397c7dd0b1c0ff9504f8b6f8e50a","sha512":"e2e11799713df02f0453f39172651bdc1e7f95004f3bff06c5994928f66f67f4ff03eb101ed71941483555486403f8660c8268d7bc3e7aad43cc2598dbc6c5ca","ssdeep":"768:HfDRTz7L+b1oFmVe/hqyqjSnx92h9hJ8oFaYPpQo7q3:LRrfmVqhkjCxkFjpQo4","tlshash":"0ae2f1b2e022c5f4bef18d4929c634d8596b74814cbac957bec048c39c595fb53b8a4b","first_seen":"2025-09-24T09:47:29.016414Z","last_seen":"2026-05-18T18:12:32.937739Z","times_seen":23,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/css/home.css","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.914Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /iocanada28com/css/home.css HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:13 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d1e-9030f\"\r\nexpires: Thu, 15 Jan 2026 03:11:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":590607,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65483)","md5":"a59fd2655d29d26e530be72b29b855dd","sha1":"709e0466ca3a05b95147b465273d74eea1cbaf7d","sha256":"1f2514892fc214cc387b5589c4b54fe9e16d09372b97f54e3b55ff776a402ff5","sha512":"9ca7048caa76feed1874d915712cc08e1b7cd765d8310f0b8a037903cbe1cf033ad23c9d5bbd55408421d58f68ef7afb8b00f856e3198c4020f04734d4260057","ssdeep":"12288:m+qNgxamFIN8Wwx21EmLsXeuZU5nh8I22Bg0jH:XqNgxTINWx21P","tlshash":"a9c4c8a49340b17dbc1bfa9897cc868e71217423e82277fced96b521c4c76f31664b89","first_seen":"2026-01-14T15:11:41.804051Z","last_seen":"2026-01-14T15:11:41.804051Z","times_seen":1,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comrongyu2-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.957Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comrongyu2-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 184574\r\nlast-modified: Mon, 12 Jan 2026 14:30:01 GMT\r\netag: \"69650569-2d0fe\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":184574,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 726x484, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"338795df6b78070bfbb4101a0631c5a3","sha1":"c2d7a019ed483112856aa712d80e6714f95b5d40","sha256":"ba6644e609163ef23ab47fa7d4427c82b292f58b7e140f9f5e7cd566a5702302","sha512":"133c09354909d7900b600ab1180f2b0d22eb7b8c760f245c766da8bb711525344b8295de36c0a1a0fcc012aa41412886b4de4850eddad64a5b4f03503757ff2f","ssdeep":"3072:Y/BpQk0wtJzAcr2xiFKTJUXcqKCymSdPRm9r21XaKYuzoMIE8k0SBR:Y/gbwbHTBX7ymIJmR21qpooX1YD","tlshash":"3c041209135b941b6dbbc260372f13747b99caa8e403741b338a851ab74ede528bdb35","first_seen":"2026-01-14T15:11:41.805351Z","last_seen":"2026-01-14T15:11:41.805351Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1708,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":536,"receive":1172,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28combanner1-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:15.092Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28combanner1-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:15 GMT\r\ncontent-type: image/webp\r\ncontent-length: 109956\r\nlast-modified: Mon, 12 Jan 2026 14:29:53 GMT\r\netag: \"69650561-1ad84\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":109956,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 635x466, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"55fdbee77dc678ac2b9085d5570fc773","sha1":"f21cdd54cb03eb255c9c70895cb39eea96bd615a","sha256":"2f8d0c9d8f30e499693a46ab0e37dfba30638692040ab3d5c11ea9d9ed3eb2fb","sha512":"5146dcf31049bd8dd2bd7c6800005fd3392b2382154681efde73c6d545446b19f902903820f00665e00d2673e1ec51d0098a2c0a010a776be654e9b43dcc3f9c","ssdeep":"1536:xN4Ic6Xeba+Ps0cS0k4+k5sHQRgElSWn+oHIGf/xzfgR/A594CgnxV1V:H7c6XYU0cSP4+ktS+DHIslgNP9X","tlshash":"a4b31237eca12d108c93b681e5de188cc1f88dbe5ae81419e7b293cf35db25cd45598a","first_seen":"2026-01-14T15:11:41.806283Z","last_seen":"2026-01-14T15:11:41.806283Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1039,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":682,"receive":357,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/leyulogo.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.397Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/leyulogo.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 11032\r\nlast-modified: Sun, 07 Sep 2025 09:35:07 GMT\r\netag: \"68bd51cb-2b18\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":11032,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"10fb9b87015af763733ca7aae9f8fd72","sha1":"22b85d9ba6d73c7318b91797df836c6dfd4c9bb8","sha256":"005515860b53ba77db3f2b66788345c397fe73449f589f426864829442c1690e","sha512":"146449caad3ea28cf16b700248d77549bb925fd2f33db7a1d614530e8fb6d47d00d873c88d654fedc9068e2ac9e529943916ddb35817d135b0257ec4a3bf978b","ssdeep":"192:zIZCU4S/HrTYSbgrqGvXdxyT6Tl+Kib2fMSk9NpduGGbh1R7bPL8P:MKWkFvryT6Via0SsXGFX","tlshash":"fd32bfb636c0359ae0c49ab56dbfb440968a065e7cdad7e3b4bd0200146eb7b3b35d81","first_seen":"2025-09-24T09:47:29.01019Z","last_seen":"2026-05-18T18:12:32.968408Z","times_seen":23,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comabout1-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.946Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comabout1-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 146612\r\nlast-modified: Mon, 12 Jan 2026 14:29:54 GMT\r\netag: \"69650562-23cb4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":146612,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 773x529, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"53bbab637e9174a1614a7e4a89b5b414","sha1":"6d96e9083bbb9af48ef58f6d9c5492a289cf1251","sha256":"11830b5652a020ebae2114117ce4f012fb142e85c8968a3b48905618385f0018","sha512":"086a9e7b54b1efd863dddaf7d545e61dd26280e10e2859fcb546dd6d876b8e15d9d800cf6fc03f7086eb8b11f6e140c146f01b1faf4ca206aade808ec8c3e779","ssdeep":"3072:MT1rr7sadxKCPhDJLnORrFaiyw8lnR4y78JcWGYrokcGZSoga:kXoadxjpJSRrFa3TWGYU/","tlshash":"c1e312764e508e4eaf416f171d8fa98348eacfe62354f37c8a2f0499ad74d6810ed0d5","first_seen":"2026-01-14T15:11:41.807893Z","last_seen":"2026-01-14T15:11:41.807893Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1680,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":543,"receive":1137,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/css/all.min.css","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /iocanada28com/css/all.min.css HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d1e-190b3\"\r\nexpires: Thu, 15 Jan 2026 03:11:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":102579,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (52223)","md5":"8dda530dfcb2ec2b1b180f55c4a1985e","sha1":"7b71ff0ec498b3d1b8107281b3b4a5446c5ddc02","sha256":"3bda3a8b1dee6700d98b1d599b594161ee7124efdbee4a5c89c950ead23b6f01","sha512":"b9c04a907b243498c08e9ea00e493f855b3464b89204b10d3006ef52d6492d8f55cb7ab9c25ac484464abc927c854e6d1528c86aef305c87a900c962281b88bc","ssdeep":"1536:1wMCMPMCMjMCM4MCMwMCM3sVMX709gbPMfjSFOTyPG9ZpgmLCq:Z709gMGFiyPG9ZimLCq","tlshash":"dba3a7f9e44c05d97732c44bab95b37c65b6f738d5810ca9f02f580c1ad26a822c6f7a","first_seen":"2026-01-14T15:11:41.808967Z","last_seen":"2026-01-14T15:11:41.808967Z","times_seen":1,"resource_available":false,"data":null}},"time_used":546,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":546,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/gate.php","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /iocanada28com/gate.php HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\nx-robots-tag: noindex, noarchive, nosnippet\r\nx-content-type-options: nosniff\r\ncross-origin-resource-policy: same-site\r\ncache-control: private, max-age=600\r\nvary: Accept-Encoding, User-Agent, Referer, Sec-Fetch-Site, Sec-Fetch-Dest\r\netag: W/\"d36d4a3956121a110a96afd809592903\"\r\nlast-modified: Sat, 10 Jan 2026 19:04:34 GMT\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1990,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"Unicode text, UTF-8 text","md5":"d36d4a3956121a110a96afd809592903","sha1":"fca59a09b59d11b881d51009ba6cd507d7a2a23f","sha256":"248db9d114b9231135bec02e312a79fa49f85cd6632ff627f42a5bffa61ecca9","sha512":"a4b6c743d53edaf7c02d11dcdeabb859a014242d80a51c08d22518843b09e596875a82e53bd73d7751b55ce17a53d0d972260a662d75d7e1eabbe7595494a593","ssdeep":"","tlshash":"a5412337ba5214311066924d3ab7c70875b2001f9a85e105b3dc901c6fadd6b1cf9bbc","first_seen":"2026-01-14T15:07:41.501206Z","last_seen":"2026-01-14T15:11:41.810037Z","times_seen":5,"resource_available":true,"data":null}},"time_used":544,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":544,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comtx1-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comtx1-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 155858\r\nlast-modified: Mon, 12 Jan 2026 14:30:04 GMT\r\netag: \"6965056c-260d2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":155858,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 656x656, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0ed8a19a93e0b1a287f9d01a868a5479","sha1":"c3855bfb89c9910b9b21f1e153c8061ce5962422","sha256":"73ac3a5961225af269ada6c5f92bcad5287992c716437cb6bab9b05a7781e905","sha512":"1087824827c1eaefc978f757afff14c3b77cf8e4b2d56698020cb6e3be6984e956d71626dd93d7bd368dc5ae2b35a1d5030c02c20892ff0479c209e46577168c","ssdeep":"3072:nutvP1kRMQAJVwgjbgDbjvFvPGKmEBRS4REPNkT8fLHtgy3ZkCdrl0N2:u1qqX4gjbsdG7mRSB2wfhgXC9z","tlshash":"92e312f26c2622741a1a6449ed1fc642cbb3327cdbf84c1e7726d9b552998d24c7de0c","first_seen":"2026-01-14T15:11:41.810587Z","last_seen":"2026-01-14T15:11:41.810587Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1730,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":529,"receive":1201,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/yu.php","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:15.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/yu.php HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://io-canada-28.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:15 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nx-robots-tag: noindex, nofollow\r\ncache-control: no-store, no-cache, must-revalidate, max-age=0\r\npragma: no-cache\r\nexpires: 0\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":12375,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"7e83f898bc085d2280854b12cb62f8d9","sha1":"205b959b34e159cf1adc05b9ab4b6a99fc18de89","sha256":"0a16e90e1474aeaaff84cf0fc23f640229269ac03fbe148de788b905d9a94305","sha512":"cb5a395e3efe83ddcb7482905d7f15ad52ee91f6cd85e7d1a3f26e982e02847f645ff19bddeb1a0c177f7e4059b459d06e07f57ab61253afcbc829efbfba830c","ssdeep":"192:TC0O/OZ5mkPHgFkF0IXvwtNlwuu5pTpp8vTp1aWTp8aDTFwuUTLlEuT0ybFSXGPm:THO/OZsiHgFA0IXvwt65wFpWa","tlshash":"d34221b181f2086712b3a0926969639b2fd9ea73c81b5b417bbc4be95fc3d91cc4310d","first_seen":"2026-01-14T15:11:41.811458Z","last_seen":"2026-01-14T15:11:41.811458Z","times_seen":1,"resource_available":false,"data":null}},"time_used":427,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":427,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comrongyu4-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.960Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comrongyu4-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 267452\r\nlast-modified: Mon, 12 Jan 2026 14:30:03 GMT\r\netag: \"6965056b-414bc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":267452,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 809x539, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"1abeb4afdc6f7ce6d1363b5f64f7baf7","sha1":"082a9ac3e3b38de5f9c544f266d2d4c16d9b0ae9","sha256":"f098425597b7dfb28a1a7a5bdf05e78ce2e22cccaba4bc80b1cbca4ddcf18a29","sha512":"8d8b025705322e6ae8c8cdd25141531325cf7ce4e66868489d18b86604c938f2dd1c79644e95e64aea95bbc1aac2bf29e5d08d31cb3546c5dadc9956ee07608a","ssdeep":"6144:wn7pQBmA33NkvsLvzVQ9N0NXj6d5JmirEbaAyAH0oq7fyCZsJ:G9ODdkCBINBJ1rYa3AHVs5ZC","tlshash":"734422857e7ad03c5f86e73c6b8ca446143c76599cfbd56aa9904cd38f01afe12382e4","first_seen":"2026-01-14T15:11:41.812303Z","last_seen":"2026-01-14T15:11:41.812303Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1762,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":530,"receive":1232,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/yu.php","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"subdocument","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:14.945Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/yu.php HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: iframe\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; path=/\njscheck=1; expires=Wed, 14-Jan-2026 16:11:15 GMT; Max-Age=3600; path=/\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with no line terminators","md5":"b13b6064fca232801a7ed3ca059c449b","sha1":"75e40db5d556460f7721f00204b126399009979c","sha256":"697c72a2041e67629aafea6df1e44ee7d1ecc89c32fbed5e86905a744ac601c0","sha512":"a5e200304051241229c9d96f6aaa0fdfcfce8312c1f9b2aa2b6fe8edc85342adec29e274608752eb07511969072a5369171df2bce50f0124b3a3410ac56e5fe0","ssdeep":"","tlshash":"2c8000ca2f08e2000ac28c2a88b0f00c08b200cb082bf82220ca3002a8083fe0e2380a","first_seen":"2023-07-17T11:42:34Z","last_seen":"2026-06-06T02:24:29.581395Z","times_seen":69,"resource_available":false,"data":null}},"time_used":740,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":740,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/background.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.390Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/background.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 16850\r\nlast-modified: Sun, 07 Sep 2025 09:34:31 GMT\r\netag: \"68bd51a7-41d2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16850,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1920x1030, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0eb2c781e3ba5951441d8cedf9d387e6","sha1":"cbd29ba91f9502cf3757f8d92da29469e196ea2e","sha256":"9e0e142bbb79c40e4ec06b28175c4f2332e8d4e6bcf10db8270418c3c9ba96cf","sha512":"fea86fe00df6dc6de8ee742faf252c575c75e21ad06baf7b4cdf7c9dbe5f0b5c09db00bc637ce16cc4171061d11af4c3219f7abe62a9c2cfbf808de92561e2d0","ssdeep":"384:1a1+BrAsLbqXyH1JVGns2mAPxJErGRL/R1DevdACI1qB:1OfzE1JV4l5Td0VA5a","tlshash":"ee72e0c9c326e485921e09b0949212f871d7bfa6754da61c49f5bfec93a483be845c33","first_seen":"2025-09-24T09:47:29.008993Z","last_seen":"2026-05-18T18:12:32.964182Z","times_seen":24,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":200,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/font/iconfont.599951c1.woff2","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.423Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/font/iconfont.599951c1.woff2 HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 31460\r\nlast-modified: Sun, 07 Sep 2025 09:00:14 GMT\r\netag: \"68bd499e-7ae4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":31460,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 31460, version 1.0","md5":"b0530b23615e0bdd80af2c1d798dfa67","sha1":"5b81dde90f5c33b9281dde774eb34fec622a3630","sha256":"407a95e9d3f3d987e7f5d7a73e7cb743c3f4525260ae3b00acff310aa719e0dd","sha512":"581639e8a210142ca9e71eeaa0ba00d4e6bdd968b80062d651d6bb04fc2c9b336b4dd39422a74f493675adcb485f70fade26a788260151379a5bc93c0bc65cd8","ssdeep":"768:cIcVR2hPAcTmEgVT9BZlkrnOQZS19fRKf:Y0hPYxxBZ66QZS1JRKf","tlshash":"87e2f147c0397083eeb52629450793e9ddbf2a91be0c5b20061b613f95ee495c3a772b","first_seen":"2023-05-18T07:54:03Z","last_seen":"2026-08-10T10:24:48.420573Z","times_seen":1060,"resource_available":false,"data":null}},"time_used":205,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":201,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/js/bootstrap.bundle.min.js","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.976Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /iocanada28com/js/bootstrap.bundle.min.js HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 11 Jan 2026 07:11:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d1e-13be7\"\r\nexpires: Thu, 15 Jan 2026 03:11:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":80871,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65249)","md5":"eedab82b15f948f7d9c5d14c03520b9a","sha1":"c11680fb4238391b241e1a03667dac1df4062df0","sha256":"a8a05ffebe24ecb2dcb698e67eb909bdda200fddc8a916a6cd0f159601c90efe","sha512":"fe5cd4bcef0aedaafd9fd8aefbd4a3c53ea9d5dcf4ca6411f663cc2fa025d89033d9d47720f4ad61a4ee076d9f77687d5e6e0a0dab5a7fb8331a37655f30b4f1","ssdeep":"1536:7SwJiEbnTl6R2t49CFliFCIg/yWszSraJd5qUFH9tZwcE+iYZMgZdj:Wwfs+SSO5q4tZwcEVYZFj","tlshash":"4b83b5593244b8730ade85b68037430bf2265998b14b812cb57cadde2a7dcc67277f78","first_seen":"2026-01-14T15:11:41.814815Z","last_seen":"2026-01-14T15:11:41.814815Z","times_seen":1,"resource_available":true,"data":null}},"time_used":517,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":517,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/9gamebn.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.162Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/9gamebn.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 27892\r\nlast-modified: Sun, 07 Sep 2025 09:33:44 GMT\r\netag: \"68bd5178-6cf4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":27892,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ce77c899674f0fbbb251da4359cd697f","sha1":"235c35f6f643584a20bfa71157129284a4088e8a","sha256":"6b12d808aa923bd5b8fd72fa6448aca5b15b7b0a04cb7c47b35dcaca0801f57d","sha512":"dfcdfb85450ad4dcd889893901416e4935e95fc88c7e1856d1103771e30ea8e381b1256798da33fe5bb1648fb71479594339d8c9fbf19ba243c1399b9766a978","ssdeep":"384:zjT/vsXC1mmPYGjSiM2FZrYKjFUb8mLg9vf44pgGDC7eqsyYyFWWby4zVZJH10/l:wy1myiiDUbzx4LO7tsjyFWWZvqE","tlshash":"86c2e187bf5cb40888b4b2cfb93ef9e6028446bc6f871175c428859a0d5b5c776d30ba","first_seen":"2025-09-24T09:47:29.014809Z","last_seen":"2026-05-18T18:12:32.950317Z","times_seen":23,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":204,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/huatihui.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.164Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/huatihui.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 38434\r\nlast-modified: Sun, 07 Sep 2025 09:34:49 GMT\r\netag: \"68bd51b9-9622\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38434,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f0d558526a340ef0a4ccd0b356468053","sha1":"d8c68232c6a01412dc710dc3c0a550a009abc3c9","sha256":"83f7a5c4d6e61fc0e54132461a188922075b494a18fb23208380894fe89a1823","sha512":"dd606c59a5ae84bb2252807c59941f37073b7cd8dad6bfb51140a7319041e5354353563a2f9632e0d10ca7a96dd7d83f355c8b2475355177df40ecc8a15c7f8c","ssdeep":"768:kZkA5GmGFqyNA4RaqIx0mSfl51sUCRPvFvuXT7frG+1j2:Gkz7FrNDaqIxGmr9u3frJ2","tlshash":"ca03010162c54baa8e6f6129f51abe77404409f2c87ef970d0d40fce1b9f983674c758","first_seen":"2025-09-24T09:47:29.027715Z","last_seen":"2026-05-18T18:12:32.933309Z","times_seen":23,"resource_available":false,"data":null}},"time_used":209,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":207,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/jiuyoulogo.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.395Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/jiuyoulogo.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 66022\r\nlast-modified: Sun, 07 Sep 2025 09:34:59 GMT\r\netag: \"68bd51c3-101e6\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":66022,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f9d82754a0c7289017f556c85562cfb9","sha1":"e326e29943603a7c5d8d345f94a12a84603ab2ee","sha256":"dd566ef9d48ad26fef3383ffcd4eeaebccac502c3a43e97eeec29fc2be67f07c","sha512":"cfdfa4d68e6777dd373062444bdd0b51dcc06680227f205d9ab1fdf4598f2459dce7700c6fe8e2d3ae0dfd38facbb0bbf3a4d73e21885f554f27a3d5add87c7e","ssdeep":"1536:v2GQ+bJZjKVYf/iB8ycpoimjc0YKEO9dChPyFc:ugjK22jcp0oOShPye","tlshash":"ef53022e2218e893d053c560934705dcff9f550eecb0b92b04a4fb0cb9ea6455b45e8f","first_seen":"2025-09-24T09:47:29.022465Z","last_seen":"2026-05-18T18:12:32.939188Z","times_seen":23,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/mk.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.396Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/mk.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 2556\r\nlast-modified: Sun, 07 Sep 2025 09:35:15 GMT\r\netag: \"68bd51d3-9fc\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2556,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"749ab1e814e220249ab6246cbdc05e68","sha1":"f002cda193dfd314b074b0c8fbe604e3e238c19f","sha256":"e4d2ef9496fedbf3fa99ff4dd0c8423fab07809830d2911b2ba3f27b25f8c6d0","sha512":"8cd6670382843930aaaf812d278e9c3645ae27c0de9c2de5cdac04c014ebac5971250b02b4e94c24f630c4f1ab5e34639b5ecbc92e7fa0797d1445726f31f420","ssdeep":"","tlshash":"80514c667118947bcbee53af81d6934602fb980257e8c4899ac30e26f012dd99fed705","first_seen":"2025-09-24T09:47:29.017519Z","last_seen":"2026-08-10T11:34:04.101277Z","times_seen":82,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/css/bootstrap.min.css","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.920Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /iocanada28com/css/bootstrap.min.css HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:13 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d1e-38a86\"\r\nexpires: Thu, 15 Jan 2026 03:11:13 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":232070,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65290)","md5":"08281e464751869caed456e3f666c505","sha1":"24dae7b42ddddf224915ff82e29e944d65c3cb72","sha256":"246730a15bca5c62d71322682aab8a615bb7071b39fc238f63c313976e4742a0","sha512":"f3f861dff95facb9a4854632c5b67d3eefaae11081ed4e506a10ab4e1f45e010dd544dffbec022f4a47427b1bf09daf53bb8027db77e6bd8ad0e41933e8db01e","ssdeep":"1536:99CnXGi9GfJkfvq5wlP7cQZDR9uvV982sYRElV6V6pz600I41r:qnXp9GfrV98II6V6pz600I41r","tlshash":"8e3482d6f590317d9ca7c1499681fefd896fa985cb120aa6f003776807cabd30962dcc","first_seen":"2026-01-14T15:11:41.817817Z","last_seen":"2026-01-14T15:11:41.817817Z","times_seen":1,"resource_available":false,"data":null}},"time_used":603,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":603,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/css/swiper-bundle.min.css","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.939Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /iocanada28com/css/swiper-bundle.min.css HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d1e-46c6\"\r\nexpires: Thu, 15 Jan 2026 03:11:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18118,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (17812)","md5":"453104c377772768165dce84703e4b29","sha1":"5a0b747b723a8edcbfe9be534da8d9c9498da6fb","sha256":"c37a97be75e1b568762a7b31af4717180a0034e843f5994918da22ab91f23c0c","sha512":"ac40e6835ac6fb02ed8ff0f6ac7bccf14929160c3e7c4d38e33977bd7aec71be85f17699590deb5042915e6849dee384aa9653d0fc935bb6df887618a6c47019","ssdeep":"192:TVmUJbiKne0JlXZHZ+Sme+jexS4nxep/a2GZb0Q5nfufKlAYfg5fyeesedOJ9A5Q:TgUbe0JdZHZ+W+SFnZ24tlWfF4XYz","tlshash":"8a8245a85340282753274f364b71cbb9dd7444d20f9389ae91c0ee48d7fadb9132f6a9","first_seen":"2026-01-14T15:11:41.818731Z","last_seen":"2026-01-14T15:11:41.818731Z","times_seen":1,"resource_available":false,"data":null}},"time_used":546,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":546,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comfuwu3-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.950Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comfuwu3-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 133610\r\nlast-modified: Mon, 12 Jan 2026 14:29:56 GMT\r\netag: \"69650564-209ea\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":133610,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 600x420, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"da685c3e9cdb63fa6d0081d9c9d1c347","sha1":"5db37fff700d9fcab68b38a6e6c9ca677eaf6f49","sha256":"f9791997f9c263e1fa1bfdd80528f92933c3dd4cdf4819063ff349af4444c37a","sha512":"d969b9961a4bf3788cc4efed6f3af3d28ff057aeb4f85f15cb0f964156268580416758034326f9ae98a1d10f900cff8d835bbd41185f95959d21440d9656d708","ssdeep":"3072:NDt8mqm7XrJhXhWkzW2nwa9/fjibd7LUP0wJ6FJP7ePa/m9JK:hmmPX1hByY2lUcwJFPa/m3K","tlshash":"61d3124de9f298ea77230c252464efd6706f0152b4df1b317259a278e03ed40ab4bdc9","first_seen":"2026-01-14T15:11:41.819556Z","last_seen":"2026-01-14T15:11:41.819556Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1695,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":541,"receive":1154,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/logo/iocanada28com/logo.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/logo/iocanada28com/logo.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10032\r\nlast-modified: Mon, 12 Jan 2026 14:29:52 GMT\r\netag: \"69650560-2730\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10032,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 489x158, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"702223b1a2cc78c7aafa8d7d81bce994","sha1":"43db256d39fa79445a5763bfe5e9818fe9d2803a","sha256":"acabbb4f876aee1a0e059bff38c10837ce3a3364627c2c93bc1d8ce7b4eab2da","sha512":"e8363e9ce35ed1e23932d5a92e5fbb95f405ee3c29176485d3df5f3ffbe7b85f0af6de8cf42c45584a981fd359ba55a0958cbba6d3c8403bfd93cad7588fa129","ssdeep":"192:tw4o58jsEkfDIaqXLA3Rt97ZhQVT2oS/wq/0ePdB0MFOOSO:tA58jsXIaqbqjZhvoS/wq3PdB0c","tlshash":"2e229f27244ae1f83d03b975a8fad61ade0b0050959dfa493c74f954ba73853410e63b","first_seen":"2026-01-14T15:11:41.820466Z","last_seen":"2026-01-14T15:11:41.820466Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1311,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":518,"receive":793,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%E5%AE%98%E7%BD%91%E9%A6%96%E9%A1%B5%E5%85%A5%E5%8F%A3%EF%BD%9C%E8%B5%B0%E5%8A%BF%E6%95%B0%E6%8D%AE%E5%90%8C%E6%AD%A5\u0026idsite=17\u0026rec=1\u0026r=577299\u0026h=15\u0026m=11\u0026s=16\u0026url=https%3A%2F%2Fio-canada-28.com%2F\u0026_id=642d9cfc89f9cf90\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=Wflifl\u0026pf_net=622\u0026pf_srv=398\u0026pf_tfr=1\u0026pf_dm1=1220\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:16.866Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tongji.kaiyunh5.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 10:00:50 GMT","end":"Sun, 05 Apr 2026 10:00:49 GMT"},"fingerprint":{"sha1":"EE:CC:71:C4:91:67:2F:88:E3:4E:4C:71:56:F8:74:AB:2B:90:EE:FD","sha256":"CD:BE:A5:E6:92:95:9A:C0:54:69:D8:53:C2:69:5D:E9:D7:D2:00:F4:4B:C2:06:6B:3D:B1:1F:C5:A4:67:71:51"}}},"request":{"raw":"POST /matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%E5%AE%98%E7%BD%91%E9%A6%96%E9%A1%B5%E5%85%A5%E5%8F%A3%EF%BD%9C%E8%B5%B0%E5%8A%BF%E6%95%B0%E6%8D%AE%E5%90%8C%E6%AD%A5\u0026idsite=17\u0026rec=1\u0026r=577299\u0026h=15\u0026m=11\u0026s=16\u0026url=https%3A%2F%2Fio-canada-28.com%2F\u0026_id=642d9cfc89f9cf90\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=Wflifl\u0026pf_net=622\u0026pf_srv=398\u0026pf_tfr=1\u0026pf_dm1=1220\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024 HTTP/1.1\r\nHost: tongji.kaiyunh5.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nContent-Length: 0\r\nOrigin: https://io-canada-28.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:17 GMT\r\naccess-control-allow-origin: https://io-canada-28.com\r\naccess-control-allow-credentials: true\r\nset-cookie: SITE_TOTAL_ID=513bc78494c38f85debc47a664f41ef9; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T16:57:26.648985Z","times_seen":17840002,"resource_available":true,"data":null}},"time_used":465,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":465,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/tb/iocanada28com/iocanada28comanquan1-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.971Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/tb/iocanada28com/iocanada28comanquan1-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 32978\r\nlast-modified: Mon, 12 Jan 2026 14:30:09 GMT\r\netag: \"69650571-80d2\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32978,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f28a518efc20f84be90e603dc7117682","sha1":"bb818a9c1928314a8aaf9cc0f92c02cff976f957","sha256":"c27f6559d1e1c44214f365668b784ae279a7f50c008579f8f78f23c77291d376","sha512":"c37deccd2ef118a7d9e80c2c02eb41e304f20a7224c6d047a7e0b90ed2aa2cc60124a8268e8f0707e40b03d08f716cad418f70e0aa52e6f8e6d75f72c186ecc4","ssdeep":"768:wvAB2IVGlNYG/EXpzZ1mmXe14LghKToDYt8PM84TZB+TUS/f:W82LH/EX0mO14LtuYCP4ZBkr/f","tlshash":"05e2e07f6816cc7bbcb112164a7d4463696a4a49e2e3b96c75f6430a3533c23fc9ca07","first_seen":"2026-01-14T15:11:41.821886Z","last_seen":"2026-01-14T15:11:41.821886Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":522,"receive":659,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comfuwu2-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.949Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comfuwu2-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 193068\r\nlast-modified: Mon, 12 Jan 2026 14:29:56 GMT\r\netag: \"69650564-2f22c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":193068,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 838x558, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c5335dcf0bd3fb93be0885ea966b3622","sha1":"63334c6f9c127d0f3fc8547ec42d8b0b039b0363","sha256":"af4946e0d2955992f9d14e80fde9f4a5f219cc17a7a48b262a66a752892f000a","sha512":"c80e5805374fda33c375781f2b2d43a10e76d4eba43d5db895e37a50d5df3968f42d74413bcbe70c99e1f243bcebb82ef1b2c7bea9e1f48378269194fc414ed8","ssdeep":"3072:ThVh/edYATE53dBLyP8y91Kib+yxlRVMMOcqJseyMnbDH26sKDK1qY4dEHQnhZ:ThVh/eWATadBk8y91j6yxlRmMnqqknbB","tlshash":"5414226c813a957ba586203d96f7f43eb0d1016fd90db46239eb3f9c291779022b4f41","first_seen":"2026-01-14T15:11:41.822928Z","last_seen":"2026-01-14T15:11:41.822928Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1695,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":542,"receive":1153,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comfuwu4-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.952Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comfuwu4-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 254388\r\nlast-modified: Mon, 12 Jan 2026 14:29:57 GMT\r\netag: \"69650565-3e1b4\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":254388,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 848x565, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"fd944685e7593e10ee08ffe0bb2f98b0","sha1":"a330a755ba1fd73da0f8a8d01270ca63ff53db4d","sha256":"19501f3e2df2a648177e4af3e0d5638f1fae108ce056945368b9fad443df6594","sha512":"c6c1da0cf210cf21768343ee53c8f0af57963ebc0e1e90ad6f2a948995a52e8bab8a01ec3d62aad02956c6d9832237273e68aed8c9d65602e72f8b9700812a77","ssdeep":"6144:3a/3INQ73mhGw5JnPaoLl16H58KtyVIrL:q/3ImChp5RPFL6H5FsKL","tlshash":"014413f077c9b0f60100b638305990bc29e5be5b99d57c6ea61fe60a36372cc687b1d5","first_seen":"2026-01-14T15:11:41.823771Z","last_seen":"2026-01-14T15:11:41.823771Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1762,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":540,"receive":1222,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comrongyu1-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.953Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comrongyu1-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 259184\r\nlast-modified: Mon, 12 Jan 2026 14:30:00 GMT\r\netag: \"69650568-3f470\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":259184,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 785x523, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e5cd45cc97a13b6397fc6483fccaeacb","sha1":"e7750af23ab577bbcb02aec45232353631c7a2d3","sha256":"a28a00c0dcbbda8a0f414a5e73d882e5b3f52a1ad8f528ec73df2d924b7ee1d5","sha512":"0b28fd7fa6550946790c361d69ec69d958be5aef4b5ac5eb36f417610e7186509133508340703b9b043b3442920511b121f8660d952a51df05701c03a0a8e085","ssdeep":"6144:Zc63txAgmGMbAOmaSaokIZ/qOOQWLshYT6e:aKtxAgmWOA9ZsYwp","tlshash":"1d44238501f221b7e48c61507b915d4642b27f98b7e9bb185c0ceadcbe5cceafb9180d","first_seen":"2026-01-14T15:11:41.824573Z","last_seen":"2026-01-14T15:11:41.824573Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1767,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":539,"receive":1228,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/favicon.svg","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:15.975Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/svg+xml; charset=utf-8\r\nvary: Accept-Encoding\r\ncache-control: public, max-age=604800\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2041,"size_decoded":0,"mime_type":"image/svg+xml; charset=utf-8","magic":"SVG Scalable Vector Graphics image","md5":"f6b2a27208cf17a806df8be9b1c10508","sha1":"63b6d70eb21917bb17221275b71105e609eeb544","sha256":"4202ec587df8b022eda865f4ff7dc2544caf373578b0e0b2f20d68fa777e556d","sha512":"094081d98ddf3a613d77ba9036a5630042f3af3ddb1c25c4a7c95f1fe41ba272764c73967f91c5adde94c8741b7d9e29d19063362d532dede53f94a18e78dff1","ssdeep":"","tlshash":"aa414c18e23d27ea21c813a56f78d4241d3e20d920d7122e971d5fb09691fe9aed8ac8","first_seen":"2026-01-14T15:11:41.82527Z","last_seen":"2026-01-14T15:11:41.82527Z","times_seen":1,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/ayxlogo.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.398Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/ayxlogo.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 9546\r\nlast-modified: Sun, 07 Sep 2025 09:34:22 GMT\r\netag: \"68bd519e-254a\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9546,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"be5dcef31622cbfb260097a78d11dca4","sha1":"869ef9932a30393dfaa89d8ff0892f113a99ab1f","sha256":"40dd354a3543414ee6a058890017485b24e8c7265fc2d61f0ad4b708451a6bce","sha512":"27ee1e7f6d965882d58858d3f2f55da2ba1a870c46f911100acf65e975927c447e63cd5d3fab71b2534b9b3f2b5206841b6dc27737777ad945c651738104e138","ssdeep":"192:CpDUlXyfWmsSgh38yuGh8yNpyEOtS+3TnNb51fgYD92Ojg0ok:UYRmsS5yPtNhWS+jd51fB2OE5k","tlshash":"4112bfca34e67542158441259fa2178cd8c29c0654cf74b7ccee3eb71e6be6d1e38411","first_seen":"2025-09-24T09:47:29.024403Z","last_seen":"2026-05-18T18:12:32.943641Z","times_seen":23,"resource_available":false,"data":null}},"time_used":210,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":210,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/css/gongyong.css","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.942Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /iocanada28com/css/gongyong.css HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 11 Jan 2026 07:11:26 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69634d1e-89992\"\r\nexpires: Thu, 15 Jan 2026 03:11:14 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":563602,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65483)","md5":"d26ae1f23c3bff3e00ef57c2cb87464b","sha1":"9014fb9acad77aebd490a7ba003b2e4a6d51e111","sha256":"338f33d682e0f948c2f59003d8001c6808032358a7499e8b20c4ff71617170ab","sha512":"6e1ba79f49fa70172665cd3904b204f0985c76c0ecdd40bcfd922d37be890c609c2dad4a32744041cb4e462bb477c8232cf207b0185fe6e94e6b12db036f7cb5","ssdeep":"3072:F7F2yDDaYMCAMHQ5h8GM2fEN0A0VPhzPF6bqbguBNiPDwYWW0KYoE:VF2yvaYMjMRN0A0PhzPF6ubp0DwYzE","tlshash":"e3c4c6689200b03cfc1ff5a89b9887cf7151b412e81267eced86b225c5d76f326b5b49","first_seen":"2026-01-14T15:11:41.830006Z","last_seen":"2026-01-14T15:11:41.830006Z","times_seen":1,"resource_available":false,"data":null}},"time_used":545,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":545,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comtx4-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.964Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comtx4-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 176972\r\nlast-modified: Mon, 12 Jan 2026 14:30:06 GMT\r\netag: \"6965056e-2b34c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":176972,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 762x762, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"34e44d13a308d70a18333976a393a6b1","sha1":"cd671459a6f2b105af69b1e8794b14cfc9c7bfda","sha256":"92f8d2b8acc08fda1b525a7e8fb29ba5ddb5d254c6eebaae0f42f2a55282506b","sha512":"2e8f603fbec42c74eb58555afee38236b9a821c6e45b799790e95f53b32db7a2aab9fe6a4bc2f5b03a787c99f5c96f9a32a3e3319d17752783d3c0639e0e7cba","ssdeep":"3072:6wuLRlwaExuNWolSz82rNt2QN0+Mf0IAhWe9Lph+DOXjXsbFfJ5UY:3GiaGZoO8sNYV+bIiW4LnmnqY","tlshash":"660412138386190d9deec8b108b26fdc24c8d1d9fd2265376da384aa0ae73dec6a5175","first_seen":"2026-01-14T15:11:41.833041Z","last_seen":"2026-01-14T15:11:41.833041Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1736,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":525,"receive":1211,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/tb/iocanada28com/iocanada28comanquan2-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.972Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/tb/iocanada28com/iocanada28comanquan2-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 49144\r\nlast-modified: Mon, 12 Jan 2026 14:30:09 GMT\r\netag: \"69650571-bff8\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":49144,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b1638201069a87386de7157487560c00","sha1":"325767b15c19b40c499d9b80bcb68e2259db27de","sha256":"aaea8165d4947f2acda66b1b8997e81f50c7d9d882c8cd9cb8ec5d29779c8301","sha512":"c933ea3722c918ae0b40e6f8484adc94cd89c45d179d83df5f4341636efa61a7a5d7eb9834297d29e6c86bca90ecc7b681d24dc42b2be7ddc428939d11d4d09b","ssdeep":"768:im7KlBRq3QdhBMiG8SMLU8Jj0CQsdYSh8dvHQC8hFWd2Zb7iTXOd5eOR1yTTgX:XKlB2kKiGzM48j0CWcQQC8C4Xi0PyTsX","tlshash":"552302c75738f16d1fc8f1f310872a27faadef47699106d1cc8d8ca642a249a7098d32","first_seen":"2026-01-14T15:11:41.836206Z","last_seen":"2026-01-14T15:11:41.836206Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1184,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":521,"receive":663,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.js","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:14.941Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tongji.kaiyunh5.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 10:00:50 GMT","end":"Sun, 05 Apr 2026 10:00:49 GMT"},"fingerprint":{"sha1":"EE:CC:71:C4:91:67:2F:88:E3:4E:4C:71:56:F8:74:AB:2B:90:EE:FD","sha256":"CD:BE:A5:E6:92:95:9A:C0:54:69:D8:53:C2:69:5D:E9:D7:D2:00:F4:4B:C2:06:6B:3D:B1:1F:C5:A4:67:71:51"}}},"request":{"raw":"GET /matomo.js HTTP/1.1\r\nHost: tongji.kaiyunh5.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 10 Dec 2025 14:05:52 GMT\r\nvary: Accept-Encoding\r\netag: W/\"69397e40-10984\"\r\nexpires: Thu, 15 Jan 2026 03:11:16 GMT\r\ncache-control: max-age=43200\r\nset-cookie: SITE_TOTAL_ID=3f97422b8ca2999ed72b1768d7f6b509; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":67972,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2923)","md5":"4b32d11120a738ec529e5d64979e9d10","sha1":"deedcd7014f47a999da6c19786713cd7a236040a","sha256":"1762dd6a64fcd59421610b68625258f9224a1f278159c4d99282adb631470465","sha512":"258a126ba730a9f57d0adef037bdf90f349265128ceb8d7d9e5c7754eb14751895dffb3220bc1da307021ea8c37c45b837064c89731313acf22a3245b3812452","ssdeep":"1536:ATgnSINAJrRJqerEKlFXhuXEjmbMNfwS9h2BLy1z71B8I6fJIKIQaFLa:AT+Z2fuqXYy1PGJ9d5","tlshash":"3963d8ce72c2753a4bcb6075a43f114ab27e9caa1448c4b4e62ac4f6383491d657bf7c","first_seen":"2025-09-25T22:45:46.07207Z","last_seen":"2026-08-11T12:50:15.207745Z","times_seen":17872,"resource_available":true,"data":null}},"time_used":2711,"timings":{"blocked":1256,"dns":1,"connect":198,"send":0,"wait":198,"receive":0,"ssl":1056},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/iocanada28com/webfonts/fa-solid-900.woff2","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:15.010Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /iocanada28com/webfonts/fa-solid-900.woff2 HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/iocanada28com/css/all.min.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:15 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 158220\r\nlast-modified: Fri, 13 Dec 2024 14:50:06 GMT\r\netag: \"675c499e-26a0c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":158220,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 158220, version 775.1280","md5":"4a6591ab5460ae5cbff1ecbd6e52193a","sha1":"7cd8afd6501962fda35d66f0e4c3b8815ac471d8","sha256":"aa75998623a391e61c6901794ace832e3ecdd288b56d608f21bea0411acc0b8e","sha512":"96c5d3283b71613b595b6b0420333bef5d64451af05c59dde27ec5b3e7cfe6e9549c604cddfbcb79cbc0fd4cd6f2e22a130c9a220b1b7ef933ac9df8c8e695d6","ssdeep":"3072:RauSB5FANIRLpsBaBrJGNG3ECNQztRvHHqkqLrlF:guSqN6ptrJGo3POh9KT9F","tlshash":"0ef312a710c6b95684a3a51b336adeb52c3ed363fcb6cd73be340114689da9c2e4d190","first_seen":"2024-12-19T10:41:23.153533Z","last_seen":"2026-08-11T16:04:31.549733Z","times_seen":33507,"resource_available":false,"data":null}},"time_used":764,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":750,"receive":14,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-14T15:11:12.615Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:13 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nset-cookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37092,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (30977), with no line terminators","md5":"0ae4093746c6e7f544a32c038d470504","sha1":"ab99379d53ef9e0bb95e8986659cd5ba12f13bee","sha256":"7a1703d4c107a8e22d6184b8cc6db9645e733401751d29c66c273f5608f8179b","sha512":"c7c220d3b35f7b3d9c32bdbf3e75ff4d7e56dc8e6c1e89986b4c7ccc23679b6cce3b99151e0c4c2f58253ae2d128c56beb08843205e759f57c7ae55c04fe9ccf","ssdeep":"768:UmBqqjF9eoLtIg39QX/jtHfJHtNEEXkZO+D0XxFC7q:UmFR9eoLtIoQX/jhJHtuOxFC7q","tlshash":"b5f2e833f20e7abb289b47ee4095775a30c2f22dc176c4407ff956da17e5ce2a600996","first_seen":"2026-01-14T15:11:41.842761Z","last_seen":"2026-01-14T15:11:41.842761Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1609,"timings":{"blocked":602,"dns":201,"connect":199,"send":0,"wait":398,"receive":0,"ssl":206},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/niubn.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.156Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/niubn.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 29966\r\nlast-modified: Sun, 07 Sep 2025 09:35:24 GMT\r\netag: \"68bd51dc-750e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":29966,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"28945c9503b45b2eb3025544093bf6af","sha1":"2d6943e01038a2498ec7207d8ab0fc8357ecd44e","sha256":"1dd82145b81a3fa77ea6b01ac046589c5dbc29cbd453e631aa9456ff7d4be1e8","sha512":"1321ff8e699c208178d1a89631ac0dcf1869573be344372df610019ec21c0c83169ebfa8a5fdeea8a328ab7a2c731f1782d533b40c9ae45c905818fc674b45c3","ssdeep":"768:Q0f+OlvtP1RystngUGaprs4uD4uj1ACbBtl3/+o4:Q0mmtNkEBpVusIbBthG","tlshash":"8ed2e115beb2674b172530aea9cde0e8d20aafd4c96f8361d03bd523551f15ab30f923","first_seen":"2025-09-24T09:47:29.018607Z","last_seen":"2026-05-18T18:12:32.958213Z","times_seen":23,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/MKAPP.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.161Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/MKAPP.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 46428\r\nlast-modified: Sun, 07 Sep 2025 09:35:20 GMT\r\netag: \"68bd51d8-b55c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":46428,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"99b9b60cd4776d948a16be0b496663c0","sha1":"e7eafeda1d0c51f3244b312de85e942e111ec1cb","sha256":"7c2c028999ec7e450fb3bac79804f0a4973062e1e1b39dd70fdc198899b6bff1","sha512":"0e7c5119a59190463f5d603201d8cc969afd5bec0dd10a7e06dbf027fb36cdba8f74687b46ddc6a9bb7d7171c44eed24209e9fef10bd17086368e64969ba99a8","ssdeep":"768:HzYqO3sUrrM+5sV/IYe5q0YAzQJ1HIAzJ1MZcmRt/errw0AZrzK7kA7co:HzYqOcIw7V/E0jJ1HIiJpwt/Sr2xzno","tlshash":"48230132f61b22b85fbdb3f694217d708c018f11ca7d49c680e295d2f45b0f4a25b9b9","first_seen":"2025-09-24T09:47:29.00799Z","last_seen":"2026-05-18T18:12:32.942574Z","times_seen":23,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":203,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/kaiyunlogo.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.393Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/kaiyunlogo.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 15156\r\nlast-modified: Sun, 07 Sep 2025 09:35:04 GMT\r\netag: \"68bd51c8-3b34\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":15156,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"37226afe020294b82ec267fab103cdfd","sha1":"b8b307dde0f00251470672845a819a98205f7389","sha256":"1c9ac810fd7faf1ec1d23b474e580b0d2224e6beb51b5dd8fc8cc131217cccec","sha512":"54d150a734f51d59d8c85f1c158408747c96a28534caaf5f26e0c8d31263d350fe7207a3cddb3db02601f3f9ce4d6bf8a93ed37416e711cfc92ee6869ed5361f","ssdeep":"384:nbTn9tCbMpfXO9KiLsJaLNXAHXk080K40nvqqZNE:bTn9tCbMpfXOIGsJ+NX6Xkyz0ni1","tlshash":"4962d1c17fc81185fa2db77a2a58c2a0d388a90c5ed7c677bd2401d2c78ce14f2a9a1c","first_seen":"2025-09-24T09:47:29.021234Z","last_seen":"2026-05-18T18:12:32.934131Z","times_seen":23,"resource_available":false,"data":null}},"time_used":206,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/hthlogo.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.399Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/hthlogo.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/css/main.css\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 18412\r\nlast-modified: Sun, 07 Sep 2025 09:34:44 GMT\r\netag: \"68bd51b4-47ec\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18412,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"a856a132c94cfe122c65e3fea41155f7","sha1":"b891eee6bcbbc6d239a88da6803d7962e5053aa3","sha256":"74f75d276694dbde95b6faba24ddc0f1f0fdd9bcadac15247a85c37920191792","sha512":"fe66855b60ae68d968788e70060e4461ae338c7d3106f7fe43a2284ec7ed228e2043bb26bc41b5a43584d05ce72cb966559d57dc3619655a5d724f9f473def19","ssdeep":"384:pRLF+p03tqJ9CMVckEWu73VRfjxdk7hllIjdlbng45YeBWK:9+m969pNEWu7FRr/k7HlQg4yeBW","tlshash":"ee82d0b63909725ed2450ce8f4146243fb95faa914391ced34afc1a32c77a64ae2384b","first_seen":"2025-09-24T09:47:29.003621Z","last_seen":"2026-05-18T18:12:32.940732Z","times_seen":23,"resource_available":false,"data":null}},"time_used":212,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":211,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cheng88888.com/link.js?0.9278177383576809","fqdn":"cheng88888.com","domain":"cheng88888.com","tld":"com"},"ip":{"addr":"122.10.18.4","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.400Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cheng88888.com","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Sun, 30 Nov 2025 05:37:53 GMT","end":"Sat, 28 Feb 2026 05:37:52 GMT"},"fingerprint":{"sha1":"67:68:64:7A:AA:CA:42:94:E8:14:C9:AF:1B:EB:09:E0:6C:BA:7E:8C","sha256":"65:BB:2E:CB:D1:0A:2C:B0:F2:CE:FF:C9:DD:38:65:E0:65:10:1D:74:AB:BC:AB:A0:94:06:C5:A3:9A:80:F9:FD"}}},"request":{"raw":"GET /link.js?0.9278177383576809 HTTP/1.1\r\nHost: cheng88888.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 14 Jan 2026 15:06:29 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6967b0f5-b1a\"\r\nexpires: Thu, 15 Jan 2026 03:11:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2842,"size_decoded":0,"mime_type":"application/javascript","magic":"ASCII text","md5":"c7656a07d710557fc36453a5a3177b94","sha1":"3bff2fcfda15ba1b13d0c7d818e6862553978db3","sha256":"a1faf75964265fadea64688779b0d5414f490cbe80ae87c169c4b4ad343062e4","sha512":"21c747a92f5b0e55169112329ea863ca80a12b62a617fd40b7f7d02449422798de20f3043be4414a003fac785dbcd05a7d6c509dd3e9af149fe180fb24a29f66","ssdeep":"","tlshash":"4f51eb6b55d54c44099b90341afb652c90bfb00fe89d98487e9ddb601fb302bfec62b9","first_seen":"2026-01-14T15:07:41.511254Z","last_seen":"2026-01-14T15:11:41.845833Z","times_seen":5,"resource_available":true,"data":null}},"time_used":999,"timings":{"blocked":396,"dns":0,"connect":198,"send":0,"wait":198,"receive":0,"ssl":205},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tongji.kaiyunh5.cc/matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%E5%AE%98%E7%BD%91%E9%A6%96%E9%A1%B5%E5%85%A5%E5%8F%A3%EF%BD%9C%E8%B5%B0%E5%8A%BF%E6%95%B0%E6%8D%AE%E5%90%8C%E6%AD%A5\u0026idsite=7\u0026rec=1\u0026r=860882\u0026h=15\u0026m=11\u0026s=16\u0026url=https%3A%2F%2Fio-canada-28.com%2F\u0026_id=4263825c1c079221\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=jbSQae\u0026pf_net=622\u0026pf_srv=398\u0026pf_tfr=1\u0026pf_dm1=1220\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024","fqdn":"tongji.kaiyunh5.cc","domain":"kaiyunh5.cc","tld":"cc"},"ip":{"addr":"154.85.235.194","port":443,"asn":134175,"as":"UNIT A17,9F SILVERCORP INTL TOWER 707-713 NATHAN RD","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:16.871Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tongji.kaiyunh5.cc","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Mon, 05 Jan 2026 10:00:50 GMT","end":"Sun, 05 Apr 2026 10:00:49 GMT"},"fingerprint":{"sha1":"EE:CC:71:C4:91:67:2F:88:E3:4E:4C:71:56:F8:74:AB:2B:90:EE:FD","sha256":"CD:BE:A5:E6:92:95:9A:C0:54:69:D8:53:C2:69:5D:E9:D7:D2:00:F4:4B:C2:06:6B:3D:B1:1F:C5:A4:67:71:51"}}},"request":{"raw":"POST /matomo.php?action_name=%E5%8A%A0%E6%8B%BF%E5%A4%A728%E5%AE%98%E7%BD%91%E9%A6%96%E9%A1%B5%E5%85%A5%E5%8F%A3%EF%BD%9C%E8%B5%B0%E5%8A%BF%E6%95%B0%E6%8D%AE%E5%90%8C%E6%AD%A5\u0026idsite=7\u0026rec=1\u0026r=860882\u0026h=15\u0026m=11\u0026s=16\u0026url=https%3A%2F%2Fio-canada-28.com%2F\u0026_id=4263825c1c079221\u0026_idn=1\u0026send_image=0\u0026_refts=0\u0026pv_id=jbSQae\u0026pf_net=622\u0026pf_srv=398\u0026pf_tfr=1\u0026pf_dm1=1220\u0026uadata=%7B%7D\u0026pdf=1\u0026qt=0\u0026realp=0\u0026wma=0\u0026fla=0\u0026java=0\u0026ag=0\u0026cookie=1\u0026res=1280x1024 HTTP/1.1\r\nHost: tongji.kaiyunh5.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nContent-Length: 0\r\nOrigin: https://io-canada-28.com\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/2 204 No Content\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:17 GMT\r\naccess-control-allow-origin: https://io-canada-28.com\r\naccess-control-allow-credentials: true\r\nset-cookie: SITE_TOTAL_ID=842717884da0d46c7ffda9ca2d7acbd8; Path=/; Max-Age=259200000; HttpOnly\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"No Content","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T16:57:26.648985Z","times_seen":17840002,"resource_available":true,"data":null}},"time_used":465,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":465,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comfuwu1-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.947Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comfuwu1-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 140950\r\nlast-modified: Mon, 12 Jan 2026 14:29:55 GMT\r\netag: \"69650563-22696\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":140950,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 680x453, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3c61679e6f21bc2f828088c56355b067","sha1":"15fb86d90ba98f587cbb426f994455889defe171","sha256":"88847434d232a3b6a0fc0ba7b388ead6e870847e855e62cc8e322670bc40e164","sha512":"eeba85baa87e4cdd715c552cc3614f37038c1c8a745454dd77cf3f3160ab577ee66f6e371fe287f12459870b3d9ab122a4b32a5f050d24842abc2c1f72f70339","ssdeep":"3072:qPQSYphO8wO9Q+eddoXWe/kKXEL3uN2j9CrgQntTilDZYkGDQWoNEUr:qYSUeO9Q++Ome/3E4bv+GkGq+Ur","tlshash":"67d31201f362c910028a9950054eec296172ef1c56a7b093bf5cf1a59bbe698adde06f","first_seen":"2026-01-14T15:11:41.846268Z","last_seen":"2026-01-14T15:11:41.846268Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1684,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":542,"receive":1142,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comtx6-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comtx6-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 161048\r\nlast-modified: Mon, 12 Jan 2026 14:30:08 GMT\r\netag: \"69650570-27518\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":161048,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 736x748, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"85c2a1fcb2fa8ac356fd2af610f7b254","sha1":"b87fdb798f6f639949428f1cd6d861ff63fd72ed","sha256":"97d23a2154de94fa81d7da930d1a71a365ae49e2f4472f26bc06c01e0ae65959","sha512":"b8f48f8b0a9c070e9663f6d5cd737393a183f2bca51399ba9d35c5381e290668ebb9e450961561e7a18f89225ccf337cea5a0602fd7128b3bebcbceb7326eece","ssdeep":"3072:sCXTBXWwfDRxmo2sAD1Qq8DCLRfvrjZDMoYglFkNZi2YZ+N0gE6oP:DXdXD98HsIL8DCLVrjy3igE","tlshash":"5cf3126d74db9d8d3af318168fe049ba0eab25ee446ed043c59a760f68748d3173d8e0","first_seen":"2026-01-14T15:11:41.847097Z","last_seen":"2026-01-14T15:11:41.847097Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1738,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":524,"receive":1214,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/tb/iocanada28com/iocanada28comanquan3-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.973Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/tb/iocanada28com/iocanada28comanquan3-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 25806\r\nlast-modified: Mon, 12 Jan 2026 14:30:10 GMT\r\netag: \"69650572-64ce\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":25806,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"0676fa5cd2bd02cd73ae6c9f6a2130d3","sha1":"c2f59159b45a4f16055025a98f138bad73555d4a","sha256":"94f3d1d022d61125d76baf7ee5a307f3ebce67a6a346425349981b00cda12370","sha512":"08f1aceb9f93840dfccbd86ddb267c0ee2425a7b032ee62056ad92ae3c0edbc471806dd5b9a66fbe2a3e5f66bea3d598fad6612e2a0fbd44bc7d233efd592188","ssdeep":"384:ch18iHO+uaeTBO7tgCs9ZAguZ0Ug5TNCrmonVJuze1pI2uuueCxPjia:NTBmydd5TIPn2WyrRnjn","tlshash":"f8c2e051bc226d8b107fe7fd50fdd4d2b829990fe6405d5f8be44a0b1829d9a7286d0c","first_seen":"2026-01-14T15:11:41.84798Z","last_seen":"2026-01-14T15:11:41.84798Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1310,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":520,"receive":790,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comtx3-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.963Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comtx3-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 110526\r\nlast-modified: Mon, 12 Jan 2026 14:30:05 GMT\r\netag: \"6965056d-1afbe\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":110526,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 745x745, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"21690e18b870f5344defc15b3354a67c","sha1":"44f974e749ff0a91b14da360082dbbe23b114a67","sha256":"94eb4260f787812b7dee9b0369fe67b2c65788785c684a8b3261209f97696546","sha512":"7a08a799f494e787d32f34c8d4b5f96057538ae6c8ec875748b7a7b675bcf8c65bde64fdcddc9eb7d694e557e87a2879adc92a6f2a868e388652a38166ff43b3","ssdeep":"1536:3M7JsiDsuEJVMcp685XtOdkkx2IhTzrc+uAFhoVROr395AElVUdCdVoYr8Lp+QsB:3M7J/SPftOqkx2WQAPd1IDpCcjAU6b","tlshash":"9ab312e78f1e25716e1120e8874e47b6682457a03d3e26a1ee180ee737d6372df2e1d1","first_seen":"2026-01-14T15:11:41.852055Z","last_seen":"2026-01-14T15:11:41.852055Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1400,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":526,"receive":874,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comcat-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:15.006Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comcat-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:15 GMT\r\ncontent-type: image/webp\r\ncontent-length: 222562\r\nlast-modified: Tue, 13 Jan 2026 16:50:16 GMT\r\netag: \"696677c8-36562\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":222562,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 816x544, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"f2790bfd90731a0299aede5a65548c31","sha1":"d32026a2bca9ed6d126001ee0c9b1a12ee5179b8","sha256":"56b423bb4caa69b9dcc9561a778e58feb0c4e27d0d6820850665b52cefac3a19","sha512":"7bc643ce8bae3da354de9532fc5ea78e707d0ff1f419ba12370386ca0e7a427ebbdf1346b268a2f61a9c654ba5e4d9437f36299563a8f885e3d5d7592037632a","ssdeep":"6144:npE+4t4SyPTnzd6+big1TJSsen4z0G06lUGp4tkvgzE9T:npF42PTnJ65+Jben4w2UGp/gOT","tlshash":"932423077666ed256d97b5af800b51453dc80d7a2b7a328887643f0523b3f825feb1ac","first_seen":"2026-01-14T15:11:41.856534Z","last_seen":"2026-01-14T15:11:41.856534Z","times_seen":1,"resource_available":false,"data":null}},"time_used":754,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":680,"receive":74,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/css/main.css","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.153Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/css/main.css HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 08 Oct 2025 18:15:31 GMT\r\nvary: Accept-Encoding\r\netag: W/\"68e6aa43-7af3\"\r\nexpires: Thu, 15 Jan 2026 03:11:16 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31475,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (31475), with no line terminators","md5":"1ea9b2c05a6abb63da00557d5cbe1de5","sha1":"c9a9df6e272943334ca12acde761d9f528b6e4aa","sha256":"137a20af221196335af9b436c05e0f37cb786532fb998b5cc91834884bc1b510","sha512":"f893782306d1ac52d319c96b2f4c4330521f55f339140e4091ce1f7867179d9a6f340cdf1d7d2aa8f6c03e30d66ac22b04533a685de9f0a67b106d16d6a160ae","ssdeep":"384:UwK6gPuYSi9lD5e115JwKUbeQuebD5YLXm3hKaJW/:w6W9lD5GabwLsJW/","tlshash":"cee2ea3c96a1503bb1778e7f61dd321d7c298813ce022799b26859ecf7c67a702a3752","first_seen":"2026-01-13T02:35:24.402443Z","last_seen":"2026-01-14T15:11:41.857902Z","times_seen":12,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":201,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/e/dongpo/tz/yu/img/aiyouxi.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/e/dongpo/tz/yu/yu.php","date":"2026-01-14T15:11:16.163Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /e/dongpo/tz/yu/img/aiyouxi.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/e/dongpo/tz/yu/yu.php\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452; PHPSESSID=3uroghd5uq6pm7eh385gpb0v5q; jscheck=1\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:16 GMT\r\ncontent-type: image/webp\r\ncontent-length: 33678\r\nlast-modified: Sun, 07 Sep 2025 09:34:16 GMT\r\netag: \"68bd5198-838e\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33678,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"20d95f56875543e3db12628ba252f807","sha1":"1d138c27eb58239897fc831978d571fdf268e569","sha256":"1e1fbae436c1c4970035f09993b0c0a41f972933f7144b401972ee23ffdb544a","sha512":"5d86196f17a03aaf428125c66a135590de7ca468c939509732444e26dcb283df179ab2a6db3cb10c0d0b067006126e836b764b9d72fe798674f9cbb601d55880","ssdeep":"768:OvQR9vvZ3UFin5prrozg0wMNLzN0o9+v+P+2bT5+DIqz7bT:OYHuMrmw4zyYPFbgIw7bT","tlshash":"80e2f120dd91e3dfd92193864ed4a2a7ee07f015d49eb0901ab558106639f9ec32a39b","first_seen":"2025-09-24T09:47:29.020056Z","last_seen":"2026-05-18T18:12:32.951107Z","times_seen":23,"resource_available":false,"data":null}},"time_used":208,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":206,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"io-canada-28.com/skin/cover/iocanada28com/iocanada28comtx7-97.webp","fqdn":"io-canada-28.com","domain":"io-canada-28.com","tld":"com"},"ip":{"addr":"156.232.139.37","port":443,"asn":134548,"as":"DXTL Tseung Kwan O Service","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://io-canada-28.com/","date":"2026-01-14T15:11:13.967Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"hi-28.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 12 Jan 2026 13:36:42 GMT","end":"Sun, 12 Apr 2026 13:36:41 GMT"},"fingerprint":{"sha1":"3B:69:5F:BC:53:E6:DB:0C:DD:9C:81:5C:1F:7A:26:3B:4C:5C:BD:4C","sha256":"81:4D:79:F8:42:81:79:13:86:16:2D:12:A1:3A:EE:D5:BC:36:8D:E5:F6:F1:86:6B:08:BE:E8:7C:FD:35:5C:6A"}}},"request":{"raw":"GET /skin/cover/iocanada28com/iocanada28comtx7-97.webp HTTP/1.1\r\nHost: io-canada-28.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://io-canada-28.com/\r\nCookie: SITE_TOTAL_ID=45f00c38dc4c44a785c0254ab5a8d452\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Wed, 14 Jan 2026 15:11:14 GMT\r\ncontent-type: image/webp\r\ncontent-length: 102044\r\nlast-modified: Mon, 12 Jan 2026 14:30:09 GMT\r\netag: \"69650571-18e9c\"\r\nstrict-transport-security: max-age=31536000\r\nalt-svc: quic=\":443\"; h3=\":443\"; h3-29=\":443\"; h3-27=\":443\";h3-25=\":443\"; h3-T050=\":443\"; h3-Q050=\":443\";h3-Q049=\":443\";h3-Q048=\":443\"; h3-Q046=\":443\"; h3-Q043=\":443\"\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":102044,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 665x665, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"26d408b8bf537a58418dc1a87fcd3cde","sha1":"6c557cdcbe9eeb7c9a1dbc35a37ae362fa4d58e6","sha256":"4ac1be1995aeb7095ca07eaf9aebd17a252efbbd64bbd45240dd80c4ab18eab7","sha512":"2eeb38762808a4d20a246a8fd12ec84db2ec4352ff1d5017f83aa7b0a9dcf8d446a45ab350a11983f6bf941ee90358019736b0f7e41426a42510c76f8442394f","ssdeep":"3072:Eto+an/mJDlbkY0YEyfAFbZb0qGtPvc/1IxHr+zjssb/iK:EtW/ecoUV06I+Xsq/h","tlshash":"d2a312a4e61b898184e387bd3f6d06ba49413438928de75c3f2c0adc9597bc5cc361f6","first_seen":"2026-01-14T15:11:41.859902Z","last_seen":"2026-01-14T15:11:41.859902Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1646,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":523,"receive":1123,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-01-14","alert":"Sinkholed","trigger":"io-canada-28.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}}]}