{"report_id":"74aaad15-6642-4f44-a399-00b2a20dc4fa","version":0,"status":"done","tags":["amazon","phishing"],"date":"2026-08-09T10:07:13Z","url":{"schema":"http","addr":"ql5b30.info/kbyxydvaa","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":0,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"final":{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"title":"Amazonサインイン","dom":{"size":16877,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (13342)","md5":"637683d7a24089a1e04b7c920c7a395a","sha1":"bc2ea15d8309e0eca3c1be32aa752c0baddb1feb","sha256":"6afc08f10fc9e2ae06f2cc28b47c5100ac43a94a17a04d331bf415f3104791f3","sha512":"1e1d857c1838d6e17006936b18ab03bae0767ca6407722950c975e82332a784d53c58f07619fc0afab457af62f33519e37dc15522f12066d55bbc994c3f53efd","ssdeep":"384:S8OuVj+Ti+6SMPlPiAng/iSDbpV9Kdnx3:Yi+61pHnPSxVCnx3","tlshash":"42723f22fa5465670123c3dab4a2678d21b2f71ec0524910d2fc82b1aefbdf7790bc65","dom_hash":"domhash842ad3b6c36e39dea34c11cb294575a5","first_seen":"2026-08-09T10:07:14.686422Z","last_seen":"2026-08-09T10:07:14.686422Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ql5b30.info/kbyxydvaa","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":0,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-13T10:07:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"summary":[{"fqdn":"ql5b30.info","ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-09T01:02:42.724385Z","last_seen":"2026-08-09T01:02:42.724386Z","alert_count":41,"request_count":21,"received_data":402130,"sent_data":11062,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"Function","is_inline":false,"md5":"29d0c84b9d1d8da446a6062c6a840ad9","sha1":"6d6b3a6065667c7c50d92f3889c85ed65a9ad784","sha256":"3c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1","sha512":"52cfcbf2f7c3521c5a6c6120099ee6822d16e04ffbc04720da925a11242c8c2050f9cfc8d864a6d39a0036ac599f701080195a29a7c5e8d3e9308b91f9f0390f","ssdeep":"","tlshash":"428004d533c350004753117c04571cc4d034447014444d405040d4531c570315115c7c","size":37,"data":"","first_seen":"2023-04-11T21:31:25Z","last_seen":"2026-08-11T05:49:14.925319Z","times_seen":741560,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/7K-YglQU.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"b3f5b0dcae5dd24e8b61ea1d80dc3690","sha1":"56637b06f1efdf06a172b2b5318d1b9e64df80b3","sha256":"ca1f4b719c9763c113368adb960fcd28d9cc04ebf9b2544d6a909253fb60f523","sha512":"a2e1d61b620dd6b833caf7fd32c3c8af5eee769a8bc48211db5fa48f9b696fe1a95d32fbf8dc92f73e14a099ba3f45abe7faf70989994e7bb7b8ffbee85c1acf","ssdeep":"","tlshash":"6ba02403744c117c4f1000350f04dd340771041c3d1403517c4d0f3403051014f0d501","size":72,"data":"","first_seen":"2025-10-02T15:25:20.179842Z","last_seen":"2026-08-09T10:07:14.746051Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/DtOJEKND.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"550c0cccdd1e2a5d81c08ed976acc076","sha1":"f210f6f132bc7b8581b7042065eacd741980df2e","sha256":"740d4f4547082ee996045f203f6429cd1111f66ff7d5151bcd2fa1ac72fe9e6e","sha512":"0ff5e930d9e4a735062ad232ce80491cdb9334dfa93bc21bb91b63a0e4df785c69f9ca63dd0eb8fb4340014d74cd46e177fe6769a7d90717d7b7ed7d429aab06","ssdeep":"","tlshash":"c7210fc213653368454f0be95eaab949402e53ed462c02d0a8541b66f243bd7f85de40","size":1168,"data":"","first_seen":"2026-08-09T01:02:47.785479Z","last_seen":"2026-08-09T10:07:14.691638Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/Qrwa9xD5.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"5c07964cc1337b634cd5efd7cac66b5e","sha1":"ff839c9034e1ccbe1d718a026fd27c90f7f2dc22","sha256":"8eeb81c7cc0507f5bd688c09d7cb10a07b659a5306dfe42c186ee45091583e88","sha512":"00c0f2917379f9ad1365508c92db5907cb94a27e758f10cc4b2b31bf39ad78778cc31d1f53ee8bcaa3b020f49f3005948e4292d25fa26d57ccc49c69a62eb2c2","ssdeep":"384:2Jyi/J3bSsuPxGXsUGhEsF8dwxL+UIZ3ojv9P0LAOl9x+qFdncD:2J7/J3bSsuPxGXsXewxmWruAcPfn2","tlshash":"9652fac9ebb0e3fca9495b5daf217ce4322e51fe7e73ca5081ce8b4595c3984b648844","size":13619,"data":"","first_seen":"2026-08-09T01:02:47.789917Z","last_seen":"2026-08-09T10:07:14.735935Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/BZOYY2zI.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"8a2632314be97db640327ecf144898d1","sha1":"9273c5b76188029ba435ded5cdce402c0e4ac86f","sha256":"80c6dfbf61e264ddadecd75e0a9f651259f074592c622b56e04ef645cf889bad","sha512":"1ca01bed98afbbd27c341fdc504801b77b7fb1cff88bd4b0b5eac8429824cdcdfb9f891c1cc93c654581834a9ac397452eb7bb2029778cb12c200a1be65677be","ssdeep":"384:j2P6NWKHjpKeiQsb43R7/bvCjLjVmBJmk2IRW+I7jQDTtXI19dUmiKHMeR5RPLpd:SyNWq9sbGR7/bglm3d+sOiPe9A0","tlshash":"da034140b5a1b86281fbeed9207712907479f793841244a4f7f48bf01f9bcb8bb7a525","size":38779,"data":"","first_seen":"2026-08-09T01:02:47.783405Z","last_seen":"2026-08-09T10:07:14.728043Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/DP54tWDA.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"eeeefaf801186d302bf405b138209623","sha1":"29ae1b9ad5066997cf8befaa17f9b194162f42ce","sha256":"56c51f31386f6ef2cc333dc68d350bbed552ac5bdb8dbdc0bffb22ffbd5f5f38","sha512":"58369c50ad5874d55f4f56286371d830bbc00417bb8cf88f082fe2cf20adea90a7b3dc66c97ad246ad40ad6335c8320ea88b876c169835ecdcc0e62c0b51a60f","ssdeep":"3072:1U1YeXB2v0u3Atc3oUx9Twh8qha+8ipgNxjxdEqavpaL/gVWZ/+BUP44A:C1YeGEtClxtwh8qM+8ZEqavpargVq++8","tlshash":"9d3449dd7286b0a153f328f1013f200af27a2a6a3449d498f199d8da3d79549c1bbf7d","size":247191,"data":"","first_seen":"2026-08-09T01:02:47.784486Z","last_seen":"2026-08-09T10:07:14.740644Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"Function","is_inline":false,"md5":"aa049e2749b8531cb8f233c2f64fc2b2","sha1":"b611a5a62c1813ae5b4763378b3a4a565556530a","sha256":"e52e51d5897d7a179089ddcf8f5de7aeb3ef4f27b054b63e937cf308b685c9e2","sha512":"fa951f3911de780608d6235a597758320388dff58cf18dd584a6941ac88cc36cac7d52caa72b678ee6f4dff47ee23955ab282714d03e713ae2bed4cb73a3c14e","ssdeep":"","tlshash":"71a0128471d6e4004b7320e40437448490396c60348c848051048c721c651108236c1c","size":79,"data":"","first_seen":"2023-04-11T21:38:58Z","last_seen":"2026-08-11T05:30:14.703604Z","times_seen":237563,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/Bu3CG8uA.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"importedModule","is_inline":false,"md5":"00fd39c8d32a8280dc0c5dc34f1597fb","sha1":"4fe310eff01e0bdcefdec9fede5a182e39da033e","sha256":"93e928cdb63c2b38adc4c1b8320a1bc9a5515f006384e27ee441935efa88cce5","sha512":"41110481f1561de0f4784dbe602f0f96a22eaa18cc3478c0f1710d3f383718d979f771109dbf9326fffafcd9ca95b8e01966a0b300b68bdabf79c97ba6308aea","ssdeep":"768:YzJENSox0h6wlGVpUQJaFJCy+K7WE+0cGzksqfz1Bc7DxnywTM95JhKS6DSBiU28:HePQ9c3wMQ","tlshash":"2303fac8b261546683e2a1a380750203f33899157408865cbb2ceef7ad7eeca7173f75","size":41114,"data":"","first_seen":"2025-07-03T13:35:13.902597Z","last_seen":"2026-08-09T10:07:14.708997Z","times_seen":8416,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/DFiHQtwb.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"5d4edee9d35e60117b56ddd2a7a254ae","sha1":"951486407f08810f1515dce83f981c132abada32","sha256":"b804e76a882df97b38b60562a066ae64a463efc079c4a60e727ab25e659c0663","sha512":"4b07c239c4f3fd308f16e4fdded27ee56dd391d43c0700b47b5f654dcea636806011b4b2d7e0133612ee88d5e23ca90be19779a8883185790c78ebc84380b2aa","ssdeep":"192:XGD5T1CLm+N0SMPpPQhOH0c+hlRs0eRi6KUKHtytaIzYGnQcY:XA5hCq+6SMPlQEShlKDRXKUKNytbO9","tlshash":"1952e8287529197f85a7c3e23160279931297fbed1028c6651fcc8703aabcfabd46d74","size":13615,"data":"","first_seen":"2026-08-09T01:02:47.787698Z","last_seen":"2026-08-09T10:07:14.719089Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/CeFjFCJv.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"13516439879cc1b388789806a0cf50fa","sha1":"e666fb5680b1f79b673230022f35c84c1027839e","sha256":"6213093e3aef48c0b5f567d60d4bb74e794fe0c0677a032fb8506b4d384f1bae","sha512":"d5261290962c66e48df41849bb0924f9ee25b6abf7ce63a4b0256e2c2efbf90970bf01a41b606099db9c9822381027ae88e5f5406c1413a04d53fa4be9e176d1","ssdeep":"","tlshash":"7c015e7c695ca03ca54f20b47a1a00034b6e8beab3d54cb2681cc57d61238bcf7ef224","size":852,"data":"","first_seen":"2026-08-09T01:02:47.788967Z","last_seen":"2026-08-09T10:07:14.733562Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/BiUq42wG.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"introduction_type":"scriptElement","is_inline":false,"md5":"79ac3aa874b94ec065c4ae9b440ff839","sha1":"8ee471474a9bf00e93a9c8b0ac2b070c36b40526","sha256":"b42ae7672d2d3de24d6ec494def9ae986147340c978977599077b6c91f5f2831","sha512":"6a2d6553188153b539882f21145dc72078b5b0a258dd52453e398713cec199ff4677151014de71aa8b9e9350ab678200f157d2bc369c926d4e11b9538b6f9e11","ssdeep":"96:vaTGnQ+ZfGL9HqNnBg6610s4QcP+vNVUj4hU+H3IHSkGdsC6:vaTGdf49K91LbeUj4aq3IykhC6","tlshash":"fea1b86cf81e0071e573c5b1ee192184121cababe466cab905bd44706fc6dfafb0d638","size":4864,"data":"","first_seen":"2026-08-09T01:02:47.778765Z","last_seen":"2026-08-09T10:07:14.723726Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/DtOJEKND.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.329Z","timestamp":1786270011329,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/js/DtOJEKND.js HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Jul 2026 15:58:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526824-490\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1168,"size_decoded":1099,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (1167)","md5":"550c0cccdd1e2a5d81c08ed976acc076","sha1":"f210f6f132bc7b8581b7042065eacd741980df2e","sha256":"740d4f4547082ee996045f203f6429cd1111f66ff7d5151bcd2fa1ac72fe9e6e","sha512":"0ff5e930d9e4a735062ad232ce80491cdb9334dfa93bc21bb91b63a0e4df785c69f9ca63dd0eb8fb4340014d74cd46e177fe6769a7d90717d7b7ed7d429aab06","ssdeep":"","tlshash":"c7210fc213653368454f0be95eaab949402e53ed462c02d0a8541b66f243bd7f85de40","first_seen":"2026-08-09T01:02:47.785479Z","last_seen":"2026-08-09T10:07:14.691638Z","times_seen":3,"resource_available":true,"data":null}},"time_used":737,"timings":{"blocked":486,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/css/Dxm0Da8-.css","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:46.101Z","timestamp":1786270006101,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/css/Dxm0Da8-.css HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:46 GMT\r\nContent-Type: text/css\r\nLast-Modified: Sat, 11 Jul 2026 15:58:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526818-5d06\"\r\nExpires: Tue, 08 Sep 2026 10:06:46 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23814,"size_decoded":6581,"mime_type":"text/css","magic":"ASCII text, with very long lines (22384)","md5":"aa0e1158d6b2b3d5fd30ae0caf98d420","sha1":"82ffa2cde12effa9ca7eaa00f1c1ef2ebdb07d7a","sha256":"853e4e82cb2dc1a1fbb517bfdf75f785441873a33c4e6408af77c9e5f95ebe85","sha512":"cd961886a07c51a2358927086864e5064cb172df35befb3adb3345cd2385c56f35c492bf0adff5e809323715a985b173824ccac067a43df76cbfdaeed37317d8","ssdeep":"192:7jxwOW9JyW9Jy4a9NTFTvhoM3JENglncALKSzfpyFqE1w/HZNSyvILb3I+zA2d:7tw89NT3oqECZcF/w/HZNSTfd","tlshash":"4bb2471e6f14053a7c5780f6f5e5eb89a226b1c5ef36a7ffac822500d7c63a71c52608","first_seen":"2025-12-27T12:14:10.013825Z","last_seen":"2026-08-09T10:07:14.698334Z","times_seen":121,"resource_available":false,"data":null}},"time_used":256,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":256,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/open/?apiName=iKTHCCuUQt53Ciz4AdiJSVIlyb68SbOQpcb5iEGyzSsctT6ezwPxATwQ2bR1cGJf","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:47.821Z","timestamp":1786270007821,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"POST /open/?apiName=iKTHCCuUQt53Ciz4AdiJSVIlyb68SbOQpcb5iEGyzSsctT6ezwPxATwQ2bR1cGJf HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 3675\r\nOrigin: https://ql5b30.info\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":3675,"data":"{\"data\":\"sVk9n3KYM9jHgBnxuqt5KfW47vQyRwPdCFLeLGj0WZ%2BTpKffbvIdHp7N%2B8NKUjg%2FwYrUMJej9PIXNrAaNJ2r47XnStcxYqvQMkcaBf8KMqBDRUFKrsvAiLDxF5JRyfQmmCkhU6VRNxSclBJS9wbe5yMAFTzN3tmO8QVVJymPhEruIJaoROQNB%2Fn2CUj%2F5Lom3jb13pXekOQI93rXbivuNvLe3uoNstTv%2Fay6W9oqbhPLbVqZxSIJsHm%2B9ykjEVoiCyljH%2BDAF1C77ti33un%2FHfXwtvsoybahCaRH1vYRh5OpMknNyviYkH56W1EiO62ON%2ByZPJ18sDaKcHZMBAI5uv2k8fCtcmI8BKEjMm3gTUocDxNEWq5vninKvZUm1hwVxB7UxFSMuGTGH22jEJgzSDivnHNLclcJ%2FuDPPoiC%2BhX1jXGtrL3P6K%2FTiBEgc%2B7o2AJ6%2F83lcBjJnsrqBNjzkO9Nn%2F0sKw5Pxa1zPdPK8wGXG8uswJS%2BCaIaf7Bd%2FEMcssmRmyeQH5yp6mPwldk433MAwktWgrH9Xwef%2FttLhILwmleK3F3BIk%2BpyXDQFo3IhJGLH8p2RP1EfEr95M9WpW4sdvS02o76xDGjq18okCNSSIpZrn13eYsw1Idy2NRYkci7NWHHd4aCm5XNUu6gUlCGLa%2FWNtjpdqgNL2XXBWs1MF7BBlb0tG7zDD%2BZJQ0fcIzr5Xp22ar5K1W0gtuzusheTmmDTHD1CYmo2a0rooLxa%2FMvNLjiYiuQoyDk3YlKs8ZhqswVHnnr4lPxLPjreQbJyLUpAf2Uf0I4o%2FTzMncheiTExVVTGLUwklg9RQvFM3X%2BgcZMZceuyQPfcVsvb4Af84S3lVhpike7Bs8mzdxMHtAF1LNN5O7JeI0lCj8YfyLjf188Hz7gNns3hYbC1ps9VnOcSJ6eeqQGlhYBGJ9SYPFEu6v8721lumg%2FrC0GmO4RSmYZGPBWZkcyydCuhsGo05EFG3D1YCqy4kGLNgH45pbKf96Kg4VYjLW6vvNAPVBmPszHmupEEWK8Fsq4zoCKLyupSW8GZv%2FBPnsgSq5VEgt1CiGAS1vjkXSW8LuapInCZg6kuixiazj5UaA%2BjNrFpvD5LtiGezN%2FGu%2BSpMQ79AmXsf599eMgIXNH62WH5K6FA9xu2Yu2xzZxC6ur2f6ZQSzAk6hyLn3zsF5uEuXt9nKhmpH10xWkbmQWCQ%2FfW6bhdoB%2FF37aOWlpTMRdFMqS3Fab10t%2FrJ%2B2M1LR%2B8aOOhgI6r68RVA78wzblLtQuzBJtv1FTF%2FEd0INUng1kkikNn4cTvL9VC7KueAUOCd%2B0C4%2FKAz20uFtt9WSMEmYhrJaTQg6aVFl6iuH0d5oSOg5A%2F%2F5B1cYLj2%2Be6pw5z8o76HRlkAbEwDtQQNns4zHFyHrpX7z6axazbXSecuccaR9LQ2dyUhBH9jQWqBUTPPy3xqG0GMZAAL9eDVaFEvTU96yhj1V0UMNmrVXBXOPTIxdxx%2Bpd9BXsUBox4rMvD5JkhpXPDhguqt0dlI7aIqpYvhLHhvxiYrBNSI2hG8gbtFBntBKTNr0qeEpFn298fVmOQYQEs33%2BspsMfnby1rtwlxAjYBaeWfw%2FUJipqKYhV7MAL70zrLTmbX%2BapVFzyr5xkDRQSOKpqR6afZR4lHVxC2TfglfM4HP8FkjMkrM6CnMF%2FmxYxWCjgm4bAQhIkeHTe%2BPujjjOqwWQm4zlIybeKK3ZHCDlfWZ3%2Fd6iSO6V4ZTP7Km6WckQpmKgnKHIicSQ%2F%2BjbbUkaO8nff1fTxXFtNVfWAcWU7XhgtC7B31r9XKApn87aPI8cvUW7KiRc2vvSzQpxC8PBTJaiZmh3HZu8KoZYDTsIy55SOkDJxroCxcpn32XEq8evdyakvNzQc5js2M2cjhTALLvMJPpEDq9iKkL9%2BaEUK9HJuZAJSK8ogmRZbdnsi3rl5atvFSOCbnfd8iLdUFF%2BHZnj5yYJd%2B2apzDm%2Fc517yEU5RBfh24GY16Q6gw5wpAA%2F%2FEqepsU2Etp76cGvcKAxYBeIQMoT2W4QNtu6SjKnSiyai9PO%2FeKhapV1W6ER81VtStNGY39VH3G1MDtnhuok5T%2FoYOdLneTBQmvK6zbgUp2Gz57aBPXvtRt9PfoEo0W6ppbiHltZ2OzH58jch8%2FYLBL6mt0cxIYZBpNRDTowuNKYXif0fM1%2Bl2moos8OhiGs%2FhekhIZ8jlizqb0cFj3Jr2nVmzlsX0T1cy%2BCiP9oag3wQmhGJoNHaexZxSajem4Be3QHiUdEBqAHbd1ZkYBDE1tWk0dpSPRrCmBGuOiEDLf%2FaabL0p32a75%2Bawb9zLx3cEnHJ1T6kD47YuGQNXccXTczVldim0Z4MwXiVYCLjes3yNoF26EnSKeRwttTi4QN1rSRFlVCf3ijm5WKIfyb1v7hMl0JBAjzIjc%2B5s5EfKse1Gj0xnJ0dt%2F8PjeUj3CIL1OQuIVh%2B%2BWkQ7LfdbWUF7OQA84ZeiQmfiHtcfm22KZIszut%2BL%2BtNnqXnOyFob2WUxOBAmc1t%2BPDxy84xavVqQaQli8AKgzElBGwAJi7ucZ%2BxtPJjjSsv9ytVfrSSlxs3Q1PWqKSq4p1k1grPok%2BEmSVtehob5zGcyue52VCjmxPkRDWf3HVKJjclMYyz0Auf%2FN0iRAx9x56zIdrklfrXoizXAjmrW5RY79WHEO8ynHj0c1GnyNVL3i4gAf5CbB2M8B5p3KL4WwaBIgtSaOhyHC2R0aaOBF2AsvlRx9NelYX9rUcahHh2mV1NCBhs26eZBGN6VkZkDYuzkNheKUvn7utd9oTodqts43cLovhz%2FMaPfXoqTW5Rymno5LYlhkbE6qQqUsxWDMGyjFFXFTaWWuHu7spXnc02lwjED%2FnCCyXVTF7iJfri6HUw2PYX1LBiUHv5AViHRg5ZWArm5vNkKYdGfD6AxN3e8tZwyiMD72lvrf2YMxUmNQRduR9w%2Fi89SlNwrQlgCm12AOrmcDxPMeDOM5OBGl7%2F%2FchW0ENVVyI96Q83HK2YOMP84yGrcHqx0NjlxSHV1E4vJ5vggFb%2FfXliqpsQWTyY6A31hqB2FXuGpvnydrSnL%2BhCgAgl4Pb1%2BD6jDdAExRdy9H5ldRCBHs1X3pwYPPxF42IbJQv3O%2F5GnxkYtxF2z9VNSjUcGpxqgZj8zRJyBDGNUBzHuGJjUfFe17VQuARSeiJU5RdVPP8w7QAnoNZFlwOpBbbPOuB2ht9J3KGxemIgWwNGOmTau%2FGA%2F9fXBvu9m6S4XDKPyXr7rZBqjk09VevCIhWkrPfv4B0pgKcv4CxiiXOaWm0hedlGLawmZ0J%2FzyZizDKx8I2%2FTfxYMmzEg2kBDioAVpUh66FHRpZhU4kMgbhyL2xniawfe4S2Ij1UKC027pFBWlRAcbjPPqKHXBKl8enNnNrxoHSCCK%2BoJQ0Wqu4NuRU8NfPSTMXX4GVd%2FxYd1aSv%2B19ObqeH2bA%3D%3D\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:48 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Origin\r\nAccess-Control-Allow-Origin: https://ql5b30.info\r\nset-cookie: locale=en-us; path=/; max-age=31557600; expires=Mon, 09 Aug 2027 16:06:48 GMT\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33,"size_decoded":423,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"e0a4a09f97c732edeabd8580d721e7c2","sha1":"f0e11c0e56128ba246d782c8678a2f88f4e2391b","sha256":"8bc55f760a8ad956e66394c3a32b26711b660c74d20d358b35ec1e3b2ba2c728","sha512":"1eca591203c21924c9b9582a162a01001acf4b5f1449f7842a0d171e99b265a34ca9bc7eb61d77ce4601e20e8d51748cc29b8d6df0072a6b9b91b6c6da0dc41c","ssdeep":"","tlshash":"9b800082020cace823233802320e2a8820e830a0c2802aaaac2c023c8f08c28e083220","first_seen":"2025-06-24T22:10:16.160171Z","last_seen":"2026-08-09T12:56:11.369867Z","times_seen":44392,"resource_available":false,"data":null}},"time_used":822,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":822,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/Bu3CG8uA.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:48.950Z","timestamp":1786270008950,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/js/Bu3CG8uA.js HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/assets/js/DP54tWDA.js\r\nCookie: locale=en-us\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:49 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Jul 2026 15:58:18 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a52681a-a09a\"\r\nExpires: Tue, 08 Sep 2026 10:06:49 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41114,"size_decoded":14647,"mime_type":"application/javascript","magic":"data","md5":"00fd39c8d32a8280dc0c5dc34f1597fb","sha1":"4fe310eff01e0bdcefdec9fede5a182e39da033e","sha256":"93e928cdb63c2b38adc4c1b8320a1bc9a5515f006384e27ee441935efa88cce5","sha512":"41110481f1561de0f4784dbe602f0f96a22eaa18cc3478c0f1710d3f383718d979f771109dbf9326fffafcd9ca95b8e01966a0b300b68bdabf79c97ba6308aea","ssdeep":"768:YzJENSox0h6wlGVpUQJaFJCy+K7WE+0cGzksqfz1Bc7DxnywTM95JhKS6DSBiU28:HePQ9c3wMQ","tlshash":"2303fac8b261546683e2a1a380750203f33899157408865cbb2ceef7ad7eeca7173f75","first_seen":"2025-07-03T13:35:13.902597Z","last_seen":"2026-08-09T10:07:14.708997Z","times_seen":8416,"resource_available":true,"data":null}},"time_used":503,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":503,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/css/YAIviPfH.css","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.331Z","timestamp":1786270011331,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/css/YAIviPfH.css HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:52 GMT\r\nContent-Type: text/css\r\nLast-Modified: Sat, 11 Jul 2026 15:58:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526818-5ec\"\r\nExpires: Tue, 08 Sep 2026 10:06:52 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1516,"size_decoded":800,"mime_type":"text/css","magic":"ASCII text","md5":"449ade720008357b82c1a6639d9d000e","sha1":"c7fbfb4570134f65f3d6c81c9cb5cb241562859b","sha256":"7618e1b035771ff50c82684c37f55ed0554aa65f3de1b570ff5b96a89537229e","sha512":"d4d6e232960dfe0f1239ed531bd48997ce62b1881ad10fa814336b33e3e8496a8722c508663e8ec6fc7f46abe7cd76f86b7237e4fc00c70699eddfd2119073a3","ssdeep":"","tlshash":"47314a520d40e315fd93c92168b3c76755345517bce23aff0d613e40d75f229ea04396","first_seen":"2026-08-09T01:02:47.777717Z","last_seen":"2026-08-09T10:07:14.712311Z","times_seen":3,"resource_available":false,"data":null}},"time_used":998,"timings":{"blocked":748,"dns":0,"connect":0,"send":0,"wait":250,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/open/?apiName=AtT4R%2B1PwvG%2FZ3q7ok2hl7VxXxzHTt2Phfh%2BzfIk%2BAsjdYvAuo4HyzXmEnsbzF9K\u0026uuid=377da18a-112b-4c94-9d4f-1b758bc2fcf2","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.333Z","timestamp":1786270011333,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /open/?apiName=AtT4R%2B1PwvG%2FZ3q7ok2hl7VxXxzHTt2Phfh%2BzfIk%2BAsjdYvAuo4HyzXmEnsbzF9K\u0026uuid=377da18a-112b-4c94-9d4f-1b758bc2fcf2 HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:52 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Origin\r\nset-cookie: locale=en-us; path=/; max-age=31557600; expires=Mon, 09 Aug 2027 16:06:52 GMT\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":59,"size_decoded":398,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"b31d2e449dea837b0a1667e0cc568ccd","sha1":"f2a9342124b0738dba571aa4a25f816d62f58a18","sha256":"8eb434031c800898502e49fa1b85131f3ab143b27d0cfceff7c7f05026f5a823","sha512":"a7b60b301b8da23327accbca029866cf274f76c8b566b5c7ecc52427e3d1739b95d71c69a04c37b7d8f689ba47e21898538df2cf04f9d5370c8c07ca4cc37c7b","ssdeep":"","tlshash":"0da0024116085ca8de527481390e1568afe53245f5441515999c553c8f05828e1a6924","first_seen":"2025-04-09T12:11:12.713224Z","last_seen":"2026-08-09T10:07:14.714869Z","times_seen":253,"resource_available":false,"data":null}},"time_used":1025,"timings":{"blocked":766,"dns":0,"connect":0,"send":0,"wait":259,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/open/?apiName=cmb9iak8ZYJbwmh6DT6O7sPSOcRXNzhuoRnPG%2Fc7F8jeChUguQrFL1Y8ky2ggnjy","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:49.671Z","timestamp":1786270009671,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"POST /open/?apiName=cmb9iak8ZYJbwmh6DT6O7sPSOcRXNzhuoRnPG%2Fc7F8jeChUguQrFL1Y8ky2ggnjy HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json, text/plain, */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nContent-Type: application/json\r\nContent-Length: 627\r\nOrigin: https://ql5b30.info\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":627,"data":"{\"data\":\"zB5vzYH4wGvptgmecGnyQS1i%2BRXXuASNHAWLBqOwcdKYhR1V5gWmWfTzyZ6Vvvq3F%2B9efRTRSk%2B6eBcjIFvZEfLfXFKlzbM03kFhld6Yqil5WHcZ2S8hlZlnTRZqAAU1C5MfbYGjMuzLaGnB3uIAimSOspHc%2FuAcYZVc%2B6QOmM%2Frcie%2FUFbVxLeWbvqk5KOo9gOT3AHBiwvuIOtvfuQm%2FfuS2j8Jx%2BICtUoR2w%2FEDvjQ4dh%2BgsP%2BJmAO%2BegwB3%2FD%2BPtHsxLsHyb49fkOAsDwQgigGEZPoGoZyBGLD16t07rDNji2roGsvk4gHPSySHP%2BJcxnpFl1ezLZWRkP1utstDy0iY67JjCLWq72oz314liS0c3ve1kE1R5vcbNDs%2BLuBzoZiCNcz%2B33XmOaSA1U9uVBhGitejbvpooaGd3Wq71zpirabGRslwstlYZEx83a8d0mfM4ryS1VJcWfBkDqyEku2v1GmTISs6f7ZEJJKAs0PhN36Kc1v1SjT2mLsU8KMWhVjq9QeTetBMHLO7f43ujqm4tpclHbTPG3RUjsmGrB8nFuZljKLa%2FdOtF%2BbO0c\"}"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:49 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding, Origin\r\nAccess-Control-Allow-Origin: https://ql5b30.info\r\nset-cookie: locale=en-us; path=/; max-age=31557600; expires=Mon, 09 Aug 2027 16:06:49 GMT\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":490,"size_decoded":713,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"7c83359fb44fcc2f244156723d7f8466","sha1":"d9a41afc2b45707d8ca7e896ce6c57e62fd2be8c","sha256":"1153dd90ea44b713c85bcdbc26d01b1a8bb0a7cebb641074c5f41d21ccaf60d2","sha512":"5bc9d891a9f949b56638fdd051102edb582bd9afb72224fe0b3c7ac4299b5842f41c6902abd21c0072185d8d96109c161efecc785bbb2bafbfe0f24dea52c786","ssdeep":"","tlshash":"21f0d4163068cdb8df8e199b1248795418ff1083b798242dfb4d5f100be1a2da027467","first_seen":"2026-08-09T10:07:14.716229Z","last_seen":"2026-08-09T10:07:14.716229Z","times_seen":1,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":330,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/DFiHQtwb.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.313Z","timestamp":1786270011313,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/js/DFiHQtwb.js HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Jul 2026 15:58:20 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a52681c-352f\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13615,"size_decoded":6032,"mime_type":"application/javascript","magic":"Unicode text, UTF-8 text, with very long lines (13179)","md5":"5d4edee9d35e60117b56ddd2a7a254ae","sha1":"951486407f08810f1515dce83f981c132abada32","sha256":"b804e76a882df97b38b60562a066ae64a463efc079c4a60e727ab25e659c0663","sha512":"4b07c239c4f3fd308f16e4fdded27ee56dd391d43c0700b47b5f654dcea636806011b4b2d7e0133612ee88d5e23ca90be19779a8883185790c78ebc84380b2aa","ssdeep":"192:XGD5T1CLm+N0SMPpPQhOH0c+hlRs0eRi6KUKHtytaIzYGnQcY:XA5hCq+6SMPlQEShlKDRXKUKNytbO9","tlshash":"1952e8287529197f85a7c3e23160279931297fbed1028c6651fcc8703aabcfabd46d74","first_seen":"2026-08-09T01:02:47.787698Z","last_seen":"2026-08-09T10:07:14.719089Z","times_seen":3,"resource_available":true,"data":null}},"time_used":252,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/BiUq42wG.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.322Z","timestamp":1786270011322,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/js/BiUq42wG.js HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Jul 2026 15:58:18 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a52681a-1300\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4864,"size_decoded":2921,"mime_type":"application/javascript","magic":"Java source, Unicode text, UTF-8 text, with very long lines (4463)","md5":"79ac3aa874b94ec065c4ae9b440ff839","sha1":"8ee471474a9bf00e93a9c8b0ac2b070c36b40526","sha256":"b42ae7672d2d3de24d6ec494def9ae986147340c978977599077b6c91f5f2831","sha512":"6a2d6553188153b539882f21145dc72078b5b0a258dd52453e398713cec199ff4677151014de71aa8b9e9350ab678200f157d2bc369c926d4e11b9538b6f9e11","ssdeep":"96:vaTGnQ+ZfGL9HqNnBg6610s4QcP+vNVUj4hU+H3IHSkGdsC6:vaTGdf49K91LbeUj4aq3IykhC6","tlshash":"fea1b86cf81e0071e573c5b1ee192184121cababe466cab905bd44706fc6dfafb0d638","first_seen":"2026-08-09T01:02:47.778765Z","last_seen":"2026-08-09T10:07:14.723726Z","times_seen":3,"resource_available":true,"data":null}},"time_used":494,"timings":{"blocked":-1,"dns":0,"connect":271,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/BZOYY2zI.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.327Z","timestamp":1786270011327,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/js/BZOYY2zI.js HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Jul 2026 15:58:18 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a52681a-977b\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":38779,"size_decoded":12359,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (38608)","md5":"8a2632314be97db640327ecf144898d1","sha1":"9273c5b76188029ba435ded5cdce402c0e4ac86f","sha256":"80c6dfbf61e264ddadecd75e0a9f651259f074592c622b56e04ef645cf889bad","sha512":"1ca01bed98afbbd27c341fdc504801b77b7fb1cff88bd4b0b5eac8429824cdcdfb9f891c1cc93c654581834a9ac397452eb7bb2029778cb12c200a1be65677be","ssdeep":"384:j2P6NWKHjpKeiQsb43R7/bvCjLjVmBJmk2IRW+I7jQDTtXI19dUmiKHMeR5RPLpd:SyNWq9sbGR7/bglm3d+sOiPe9A0","tlshash":"da034140b5a1b86281fbeed9207712907479f793841244a4f7f48bf01f9bcb8bb7a525","first_seen":"2026-08-09T01:02:47.783405Z","last_seen":"2026-08-09T10:07:14.728043Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1045,"timings":{"blocked":523,"dns":0,"connect":0,"send":0,"wait":522,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-09T10:06:44.782Z","timestamp":1786270004782,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 301 Moved Permanently\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:45 GMT\r\nContent-Type: text/html\r\nContent-Length: 169\r\nLocation: https://ql5b30.info/kbyxydvaa/\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T05:57:28.976551Z","times_seen":17831158,"resource_available":true,"data":null}},"time_used":836,"timings":{"blocked":-1,"dns":67,"connect":250,"send":0,"wait":251,"receive":0,"ssl":267},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/favicon.png","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:47.318Z","timestamp":1786270007318,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/favicon.png HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:47 GMT\r\nContent-Type: image/png\r\nContent-Length: 516\r\nLast-Modified: Sat, 11 Jul 2026 15:58:14 GMT\r\nConnection: keep-alive\r\nETag: \"6a526816-204\"\r\nExpires: Tue, 08 Sep 2026 10:06:47 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":516,"size_decoded":851,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"11b2e63f0ad7440683da67fc5aea1ae8","sha1":"4ca8f900a09775c36405106ff12c3d31cbdf908a","sha256":"78d23af2cd79bce1640dd74fd18a8741574a770b74242f024a555fb584dbc33c","sha512":"e194427f40190ec9fc444fab68bd74c88ca2c6e2211010f96e61278f2e2f4b7b95d61e8e0127fb72eb516692ac6d65ea2da744b89993f33039162b0b159706cf","ssdeep":"","tlshash":"51f075ddbd1f0836619e055c41c39480da613908a2c7157e07ca076c4013c1888f4f3b","first_seen":"2023-05-21T13:30:13Z","last_seen":"2026-08-09T10:07:14.732514Z","times_seen":3291,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"wss","addr":"wss://ql5b30.info/socket.io/?isnu=1\u0026c=1\u0026p=1\u0026type=user\u0026uuid=377da18a-112b-4c94-9d4f-1b758bc2fcf2\u0026EIO=4\u0026transport=websocket","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:50.288Z","timestamp":1786270010288,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /socket.io/?isnu=1\u0026c=1\u0026p=1\u0026type=user\u0026uuid=377da18a-112b-4c94-9d4f-1b758bc2fcf2\u0026EIO=4\u0026transport=websocket HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://ql5b30.info\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: 6sPgRS4IPtAyIOtKUMUIlA==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 101 Switching Protocols\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:50 GMT\r\nConnection: upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Accept: X1jibfXiwWtrguyc3OXBFMLt24I=\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Credentials: true\r\n\r\n","headers":null,"cookies":null,"status_code":"101","status_text":"Switching Protocols","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":260,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T05:57:28.976551Z","times_seen":17831158,"resource_available":true,"data":null}},"time_used":758,"timings":{"blocked":0,"dns":0,"connect":251,"send":0,"wait":252,"receive":0,"ssl":255},"alerts":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/CeFjFCJv.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.316Z","timestamp":1786270011316,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/js/CeFjFCJv.js HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Jul 2026 15:58:18 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a52681a-354\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":852,"size_decoded":941,"mime_type":"application/javascript","magic":"Java source, ASCII text, with very long lines (851)","md5":"13516439879cc1b388789806a0cf50fa","sha1":"e666fb5680b1f79b673230022f35c84c1027839e","sha256":"6213093e3aef48c0b5f567d60d4bb74e794fe0c0677a032fb8506b4d384f1bae","sha512":"d5261290962c66e48df41849bb0924f9ee25b6abf7ce63a4b0256e2c2efbf90970bf01a41b606099db9c9822381027ae88e5f5406c1413a04d53fa4be9e176d1","ssdeep":"","tlshash":"7c015e7c695ca03ca54f20b47a1a00034b6e8beab3d54cb2681cc57d61238bcf7ef224","first_seen":"2026-08-09T01:02:47.788967Z","last_seen":"2026-08-09T10:07:14.733562Z","times_seen":3,"resource_available":true,"data":null}},"time_used":251,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/Qrwa9xD5.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.328Z","timestamp":1786270011328,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/js/Qrwa9xD5.js HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Jul 2026 15:58:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526824-3533\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13619,"size_decoded":6762,"mime_type":"application/javascript","magic":"ASCII text, with very long lines (13618)","md5":"5c07964cc1337b634cd5efd7cac66b5e","sha1":"ff839c9034e1ccbe1d718a026fd27c90f7f2dc22","sha256":"8eeb81c7cc0507f5bd688c09d7cb10a07b659a5306dfe42c186ee45091583e88","sha512":"00c0f2917379f9ad1365508c92db5907cb94a27e758f10cc4b2b31bf39ad78778cc31d1f53ee8bcaa3b020f49f3005948e4292d25fa26d57ccc49c69a62eb2c2","ssdeep":"384:2Jyi/J3bSsuPxGXsUGhEsF8dwxL+UIZ3ojv9P0LAOl9x+qFdncD:2J7/J3bSsuPxGXsXewxmWruAcPfn2","tlshash":"9652fac9ebb0e3fca9495b5daf217ce4322e51fe7e73ca5081ce8b4595c3984b648844","first_seen":"2026-08-09T01:02:47.789917Z","last_seen":"2026-08-09T10:07:14.735935Z","times_seen":3,"resource_available":true,"data":null}},"time_used":811,"timings":{"blocked":539,"dns":0,"connect":0,"send":0,"wait":272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-09T10:06:45.626Z","timestamp":1786270005626,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/ HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:45 GMT\r\nContent-Type: text/html\r\nLast-Modified: Sat, 11 Jul 2026 15:58:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526824-845\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2117,"size_decoded":1275,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"8e572e425e2a9e4c1daa08be0f1581b7","sha1":"6f0ab0ced557dd46db5e8b8f275e0fdb9cb67224","sha256":"ec926d7626d6a314fe7b1f879dea68bf8e1214e65ae8578257fad2cc2ce07f7f","sha512":"93c9524bf7d4421b8e30dc03705f66612999fab995a1f6c9d0e2991ec98244cabae8875063203dd1581cede971170c197c65227bbdcdca09b02ba5aba8a89ff1","ssdeep":"","tlshash":"ed41dd2358118c196330c2666de2b54982b2eb2de7686da0e2dd35ef5dc4fc1c5e322b","first_seen":"2026-08-09T01:02:47.773386Z","last_seen":"2026-08-09T10:07:14.73852Z","times_seen":3,"resource_available":false,"data":null}},"time_used":251,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/DP54tWDA.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:46.099Z","timestamp":1786270006099,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/js/DP54tWDA.js HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:46 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Jul 2026 15:58:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526824-3c597\"\r\nExpires: Tue, 08 Sep 2026 10:06:46 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":247191,"size_decoded":104919,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (25915)","md5":"eeeefaf801186d302bf405b138209623","sha1":"29ae1b9ad5066997cf8befaa17f9b194162f42ce","sha256":"56c51f31386f6ef2cc333dc68d350bbed552ac5bdb8dbdc0bffb22ffbd5f5f38","sha512":"58369c50ad5874d55f4f56286371d830bbc00417bb8cf88f082fe2cf20adea90a7b3dc66c97ad246ad40ad6335c8320ea88b876c169835ecdcc0e62c0b51a60f","ssdeep":"3072:1U1YeXB2v0u3Atc3oUx9Twh8qha+8ipgNxjxdEqavpaL/gVWZ/+BUP44A:C1YeGEtClxtwh8qM+8ZEqavpargVq++8","tlshash":"9d3449dd7286b0a153f328f1013f200af27a2a6a3449d498f199d8da3d79549c1bbf7d","first_seen":"2026-08-09T01:02:47.784486Z","last_seen":"2026-08-09T10:07:14.740644Z","times_seen":3,"resource_available":true,"data":null}},"time_used":1006,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":504,"receive":502,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/css/Dd5EKhXL.css","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.318Z","timestamp":1786270011318,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/css/Dd5EKhXL.css HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: text/css\r\nLast-Modified: Sat, 11 Jul 2026 15:58:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526818-5ee\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1518,"size_decoded":790,"mime_type":"text/css","magic":"ASCII text","md5":"17ecf88a9931c8d6775dc17240ab83d7","sha1":"a93152e72a7856fea137cf6ff8b0422afb8a3083","sha256":"29fcbf88c2a008e0eb085791758f9fa6411c68c935dfb7f77f22321a346e08a4","sha512":"fdd8881d9268aca015fef28d016a0ffa8944b6e660531b8fcc5dde9bba9612c6e0729b1ec979d8f019f0893dd5d8857be2b99079b82287dd260b54acd0a17b30","ssdeep":"","tlshash":"123117422889a351e887d861a9bbd35360751447bee27bff2d0abc41eb5f208aa18705","first_seen":"2026-03-14T03:28:24.74289Z","last_seen":"2026-08-09T10:07:14.742951Z","times_seen":4,"resource_available":false,"data":null}},"time_used":780,"timings":{"blocked":-1,"dns":0,"connect":258,"send":0,"wait":258,"receive":0,"ssl":264},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/css/DcZA527k.css","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.319Z","timestamp":1786270011319,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/css/DcZA527k.css HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: text/css\r\nLast-Modified: Sat, 11 Jul 2026 15:58:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526818-739\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1849,"size_decoded":968,"mime_type":"text/css","magic":"ASCII text, with very long lines (419)","md5":"48a122b239c64b3b0d77ff81e1856b61","sha1":"883de7b71236e303d24f1a3c2dfc99cc34586ef1","sha256":"4b755317cd6ba347977c47d40ea755ea80c8215e126d537f9dc3f068ec37cd9a","sha512":"32f11962a594660b5af22485300804c8142af4376061282623a715c0753e96ef034d5057350073c260ce9dd99b4ef79d0eb9bf8e1518af42ded14446a27ac992","ssdeep":"","tlshash":"ed31d6521c45a302f983c00678f2c31b51349267bcf23bbf9c04b991db9f38e8959704","first_seen":"2026-03-14T03:28:24.739811Z","last_seen":"2026-08-09T10:07:14.745114Z","times_seen":4,"resource_available":false,"data":null}},"time_used":755,"timings":{"blocked":-1,"dns":0,"connect":250,"send":0,"wait":250,"receive":0,"ssl":254},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/js/7K-YglQU.js","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.324Z","timestamp":1786270011324,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/js/7K-YglQU.js HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=1\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 11 Jul 2026 15:58:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526818-48\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":72,"size_decoded":469,"mime_type":"application/javascript","magic":"ASCII text","md5":"b3f5b0dcae5dd24e8b61ea1d80dc3690","sha1":"56637b06f1efdf06a172b2b5318d1b9e64df80b3","sha256":"ca1f4b719c9763c113368adb960fcd28d9cc04ebf9b2544d6a909253fb60f523","sha512":"a2e1d61b620dd6b833caf7fd32c3c8af5eee769a8bc48211db5fa48f9b696fe1a95d32fbf8dc92f73e14a099ba3f45abe7faf70989994e7bb7b8ffbee85c1acf","ssdeep":"","tlshash":"6ba02403744c117c4f1000350f04dd340771041c3d1403517c4d0f3403051014f0d501","first_seen":"2025-10-02T15:25:20.179842Z","last_seen":"2026-08-09T10:07:14.746051Z","times_seen":6,"resource_available":true,"data":null}},"time_used":494,"timings":{"blocked":-1,"dns":0,"connect":262,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ql5b30.info/kbyxydvaa/assets/css/4QAIC-eb.css","fqdn":"ql5b30.info","domain":"ql5b30.info","tld":"info"},"ip":{"addr":"47.74.45.115","port":443,"asn":45102,"as":"Alibaba US Technology Co., Ltd.","country":"Japan","country_code":"JP"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ql5b30.info/kbyxydvaa/","date":"2026-08-09T10:06:51.325Z","timestamp":1786270011325,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ql5b30.info","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Sat, 08 Aug 2026 02:49:09 GMT","end":"Fri, 06 Nov 2026 02:49:08 GMT"},"fingerprint":{"sha1":"E3:E7:2F:D4:8E:EA:CC:27:25:C4:C3:3E:A4:F1:75:70:98:B8:37:D9","sha256":"C1:0A:90:EA:68:1E:CD:2F:09:4B:06:C7:75:8F:A4:0A:5B:D7:E9:C1:4F:0D:B3:32:B0:1E:1B:EF:CE:4D:82:CC"}}},"request":{"raw":"GET /kbyxydvaa/assets/css/4QAIC-eb.css HTTP/1.1\r\nHost: ql5b30.info\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ql5b30.info/kbyxydvaa/\r\nCookie: locale=en-us; uid=IInJ9SyUXb5RZDUR\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.28.2\r\nDate: Sun, 09 Aug 2026 10:06:51 GMT\r\nContent-Type: text/css\r\nLast-Modified: Sat, 11 Jul 2026 15:58:16 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nETag: W/\"6a526818-5ee\"\r\nExpires: Tue, 08 Sep 2026 10:06:51 GMT\r\nCache-Control: max-age=2592000, public, max-age=2592000\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.28.2","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1518,"size_decoded":806,"mime_type":"text/css","magic":"ASCII text","md5":"1f4e9ecd14038eb7d6fd381614175b80","sha1":"ef16c348815cc024aa1c8783895a7f96d3891ebc","sha256":"dabc8bac6d9cde549425e74b2f886c401f3df75ea22696bad376b5a03d662921","sha512":"a81d509d21848f3e117e2c90446102a66777ee042e01b36cabb487dfc396f5f7837687c205814ff73fae6c11db4ad375e9043c4fe37cfbf936d546ac1fd8e5bc","ssdeep":"","tlshash":"db3139a30c08a720fc93c5222db3d3162135446bbce23aff4d187a82e69f20a990a350","first_seen":"2026-03-14T03:28:24.748015Z","last_seen":"2026-08-09T10:07:14.74786Z","times_seen":4,"resource_available":false,"data":null}},"time_used":741,"timings":{"blocked":490,"dns":0,"connect":0,"send":0,"wait":251,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-09","alert":"Sinkholed","trigger":"ql5b30.info","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Amazon","verdict":"phishing","severity":"medium","comment":"Resource associated with Amazon phishing","tags":["amazon","phishing"],"meta":null}]}}]}