{"report_id":"75213958-6ff2-4ea2-915a-f82ea75e2157","version":6,"status":"done","tags":[],"date":"2026-01-06T05:38:16Z","url":{"schema":"http","addr":"neweex.cc/","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":0,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"neweex.cc/#/pages/login/index","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"title":"EEX GROUP","dom":{"size":123022,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (15342)","md5":"1284e65f7a65dc680e28371f29704bd3","sha1":"1cba06a49caafaa17468a1091007447999b86373","sha256":"47924ea66e1ac3eedd0cc92feb1b17c51e70b5b05ebeb7e53bc1e66329713364","sha512":"3be4211bc8f256024a287712ea49de47948c6459d5f6b90b4f77a12ba552b8e7225bf9f2536cd0aeae8586a9f67077d82e4a214a4044bfc1a1d131bcb10332df","ssdeep":"3072:bODe/ueqZIbfhcexccZDUV2ON/qtbjavj/6t:SsuVCbfhBavj/6t","tlshash":"27c3d5317b5a243de537cd66d0a3f9a67300a733826296ebfb65b921cfd94c4262035c","dom_hash":"domhash29c4b36266fb746dc085e8ee3e1b2d24","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"neweex.cc/","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":0,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-02-10T05:38:16Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"aa.jjxblhzi.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"neweex.cc","ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-11-12","domain_rank":0,"first_seen":"2025-12-08T21:17:07.908866Z","last_seen":"2025-12-08T21:17:08.987193Z","alert_count":12,"request_count":12,"received_data":1255600,"sent_data":6259,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"aa.jjxblhzi.top","ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"domain_registered":"2025-04-02","domain_rank":0,"first_seen":"2026-01-06T05:38:17.702093Z","last_seen":"2026-01-06T05:38:17.702093Z","alert_count":8,"request_count":8,"received_data":22882,"sent_data":4098,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"at.alicdn.com","ip":{"addr":"47.246.44.178","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Sweden","country_code":"SE"},"domain_registered":"2008-06-25","domain_rank":96084,"first_seen":"2013-11-28T05:03:29Z","last_seen":"2026-01-05T09:03:01.851064Z","alert_count":0,"request_count":2,"received_data":67486,"sent_data":1038,"comment":"","tags":null,"fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}]},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.222.174.117","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-01-05T13:13:41.270215Z","alert_count":0,"request_count":1,"received_data":579,"sent_data":440,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-login-index~pages-login-reg~pages-user-add_bank~pages-user-moditypwd~pages-user-renzheng.2bf05296.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"d73bb926b1649bf82bf46875bb668824","sha1":"92d38ed743d353ee838a935cc9b71eec183531e0","sha256":"5b778ac9a0e0f8867d9302081ee5197cbd1212a27d8c063a8dc8b8247c534382","sha512":"5764ab2897a7a7e207cd6aef2f191a01319a4437b50f8fa5ae7b95e449ed6d5c9dfccb06d8aebe3c8ba6f45e199e5cc5981a6f669e383b388d0b19cffdf3935d","ssdeep":"768:b43B35d9oK+BA2BcFL1eXleTHeu2e7xeuqeu5eubeuYeNseueeuweT+euqleuDuO:s3BTB+bBDjtdUi","tlshash":"dfe2d68c73ddb01e46d365e4601f100ba377b968581ae842e3f2a1e59eb175e0233fb9","size":32024,"data":"","first_seen":"2025-12-08T21:17:13.867963Z","last_seen":"2026-01-06T05:38:23.478343Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-login-index.38ba0cec.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"8f96c95b4794ce22f3c341162dc3f1ee","sha1":"13fcdfee07ebfd6218fcc30ba4a235b671376149","sha256":"53ece167a24cc90c1bc9282f30f4e73982103171769534cda22125f6041695c3","sha512":"bdef4d1976badfd521d4c4d216959728ebb15f3f38caca68b32981b249ef2922f387db40b0ccc31cec7267f8c72e4f6690e79c0fb1ea5a2819e95a8ee2683006","ssdeep":"384:Jp5nE77pf0et7gQFS4b3YTBGQeFRjjUXN:het7gQFbjF5E","tlshash":"45a2c61d70c99c7b3fd6a4d4002f2106239e5e548de2be42b7768b918bbe549212ff68","size":23021,"data":"","first_seen":"2025-12-08T21:17:13.87577Z","last_seen":"2026-01-06T05:38:23.465085Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"93368157fb131b56a45d6f60f8b40342","sha1":"ea2a25edb7b00c3e0a06650f02fded5bd87dfa20","sha256":"c48d4859bc082aa591168f7d7230bef438ecc2b3074e707c83864e11ec1a891f","sha512":"366c90d022f7fd6718d76460de51a154cf6cf8bf8e3aefa2e0e736cbba24ec53506485331abd3c3c2a7e6ae00c9a3b957a9aa675ecdd389afca7863ad8365908","ssdeep":"","tlshash":"c8e068c260a6294c02208016304ac1031bb608729ec149613c4c67a58fb9f4bc46e859","size":352,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-07-24T17:52:39.973252Z","times_seen":4588,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/index.dbbd0d59.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"b8df333c7649f795abdb3da1434a1e0f","sha1":"606c58d302b36fb4318779f02aa6bb6f5a5b7041","sha256":"b3652c1bc82f51bb6afdf4ca4c80334ef3dd388e9ec9c630c40812a1c50c1832","sha512":"056212c058fb2ddff4841f0612137b329bf61a0b5d290b3274cee632270a257177cbfed0a426230be30aea001312f9684087efb848dd5e6d18627c4ea525be89","ssdeep":"3072:WxwHt7KtKiNud2OUc5rJODe/aeK0IbfrMF9s93eYAiP6u9XsABAi/+jpfeDsbEJ8:iOdR8satjbfy9s93FP6gBMpfJAAih86K","tlshash":"30545ce8bac969beaad38c94d017956933113d665007f493f3f2f954cbadbc49034b28","size":302189,"data":"","first_seen":"2025-12-08T21:17:13.889927Z","last_seen":"2026-01-06T05:38:23.496711Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/chunk-vendors.16bdea55.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"7dcb35824d856b15fa3be41f1fae6f52","sha1":"97a08107a166c96628d42fbdd3e4e92470ab2427","sha256":"a6b8beed602993e8dac36b5413cb5e5f36b7378c646e1dc642ce780c595a082b","sha512":"63dadd66595da2d325518e5f5c4b7cad897ebd52a3cc9101d493d2cb57a6decc8c621ffac1a5a7c519178d10d8925a9f1457aaf9a8251e8cbb36879f540d04cf","ssdeep":"6144:dcCMNkYaCGRDlzRpRrxbZhdjqphyI5GkFk1l9WP8Zy0sqO73bPB:ANShz3grGR1l0ck3bp","tlshash":"24e4089cf285b0a607e761f5003f220bb23b6968b40a94d9f275e4d4ad78d8e5137f78","size":699513,"data":"","first_seen":"2025-12-08T21:17:13.862731Z","last_seen":"2026-01-06T05:38:23.491932Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-index-index~pages-login-index~pages-login-reg~pages-recharge-index~pages-tard-index~pages-user~af2b1eb1.cc38aa65.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"3b07d33a6fa17610880b7a6cd17c3b39","sha1":"b9d0750e3534d86586cdbbbf15a4b54ad12d113f","sha256":"9fa045163f31567f26dda59088a1b1b75f044a1c28aa53f4e65ea99e5cfa4e8c","sha512":"3ab01378b499de4c067b64b6463c95ddd9fea77ba84d34f21e65f60cb096aaf360f7634bb3145d92821face8ee076a654c331e6b871a28d0c0fa8e3116e9f328","ssdeep":"192:dC/l3MOZfFWGT3cqR7eknRTeknycJMOFaPueDe+bxyZv4Lk5PiN9lgPl1+PEU1bA:dkR7ZfFWezR1MOUuWfbxyZvx1+sM0","tlshash":"39829559f08db51b0bd3cd28518fb50066653b87986076c8bbe2a9f08f576ad311af0b","size":18514,"data":"","first_seen":"2025-12-08T21:17:13.884737Z","last_seen":"2026-01-06T05:38:23.483473Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-index-index.e22bdb81.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"4d0a048e19853a01e5aa16e125cf3827","sha1":"037f02298ad5ddcb65d190992e4c41216739619f","sha256":"946c5982412dfda3b5e91c53066c5a2b8e3f30cf3ae7cbc9d86e7e114e35891f","sha512":"a582110865e84c031e47474c7de47f8ea84e684139284591259bd03143d6f9d47f835f8c615e28ee3a60cf26fd19992cae8b434df941fbe82116cec20d6adec7","ssdeep":"768:y9jcK0Yab1KquA42VycxccZDUV2ON/mftb5FXhtxgZq1XtqRqhjP3:y9jZ0pRKvAPycxccZDUV2ON/qtbvXJgK","tlshash":"4af2e71df08eb41b8ad3a8a400df094950372d6a9515f294f7b6c6b0cfb718e2329f8d","size":36072,"data":"","first_seen":"2025-12-08T21:17:13.873916Z","last_seen":"2026-01-06T05:38:23.486345Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"fec22a207bf278b99028d03faf700ecc","sha1":"58462adeb1661ba7e8117ae0a73aca785c0cc74d","sha256":"81d86cfd90285fe38b0c2f8cf59864a3705e8c9717fdaa9b1c9a7d535814c1b7","sha512":"7b3ea466f4082faeac003bace88ec9a591975028149e56e708ff83b313825e05aea79d2bd7dfdbf9b61388266d80b58ed773b52acb1bf28ef4c00289919cf050","ssdeep":"","tlshash":"1d310f5183bab678c7c930edb957cc65023a0c09b6f5e7cc9917dc50a944836f2156eb","size":1729,"data":"","first_seen":"2025-12-27T12:04:44.63972Z","last_seen":"2026-01-08T05:39:39.013167Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-index-index~pages-login-index~pages-login-reg~pages-order-index~pages-recharge-index~pages-tar~33f17ee8.9bb17b0b.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"0899ab94fa6eb0b20a25dff36d4d7458","sha1":"22dcf08912cbf0db7beea626709ce4141e145445","sha256":"3715a889311f9109d256f83daa323923226d0dc57bcaf61c6ae8d421a1085eeb","sha512":"3457be2e604f7ed63d6f39ae8ad71452c3cda8f46330ca71d110525c65ff2c2e07fb8446c66df96b14a6039b96699b13050246048cd8ef08da24de5908a940c4","ssdeep":"192:d9PB63uH7IrehKwJcDn3fj29EwogwgmJNIpGbl/V571Pi+AJ8k:d9P8I7eliHmMpW4D","tlshash":"e752b90db19df59b86c304b0502f2206a1623dbe6d29f953d7f286e44b3679e3122f6d","size":13226,"data":"","first_seen":"2025-12-08T21:17:13.879666Z","last_seen":"2026-01-06T05:38:23.493583Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-index-index~pages-user-index.283699af.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"6a2a419d4213902be96477453fcc4958","sha1":"0863c43ca382b1dae754ebd61a8dc149bdbde35a","sha256":"0155b2c35d5490594b654f191852095c9fa1f9889ea5e3fac5d0e2f44eabdb43","sha512":"d651a40e7b150fd3f1c0467429730b621907aa179277beb70337d595a12cca73cf5e5de9df07e69449469b7d56ba974cf58e1a96e9cbdb3afef5f47392d28285","ssdeep":"384:0kOl0unIln5is09t7gQFi/Z2ep6TfEgUX98:0kb+IJ5iN9t7gQFi/Zfp6DEJ8","tlshash":"7e62612db0c99cb73fd9a4c4406f600663de6a15cee17d02b77a8b858b7e249102ff64","size":14810,"data":"","first_seen":"2025-12-08T21:17:13.872246Z","last_seen":"2026-01-06T05:38:23.460588Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-login-index~pages-login-reg~pages-recharge-index~pages-tard-index~pages-user-add_bank~pages-us~5444fab9.669dd9cb.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":false,"md5":"e1d74180242d57d0a017231981750a8a","sha1":"742529272ee84a9adfa504c342e15bccbc7011c2","sha256":"396be872ace10ea8ff6518ef9b2844819a0810a86585a10d0cc7c0b9d1a0ef54","sha512":"3da3ae9a75e11029def9c7c8cde2ded5b5c6d0660fb1a7da5f3fb540aa06ae2d10783b9fe681e481a30bae6c476f4a0617abab8639d4decb73c149dea34fe515","ssdeep":"192:b11sX3uYytVRl0Fka7tNWa+HFIZobYwcwEC0uBvjDLm2G0zzqD35qUN:b1eX6lv3lQgdzE35FN","tlshash":"e342932c708cf5c34ad3983061bb250792712a899c596590a7b5a2f447bfb8c1337f6e","size":12844,"data":"","first_seen":"2025-12-08T21:17:13.853417Z","last_seen":"2026-01-06T05:38:23.490219Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":[{"md5":"3d5272693eb411e5b8b13a243f76c720","sha1":"6a586ab8e0a4bf12bbc60eea6ca9f2418625a22c","sha256":"9582f31f9eb892b8823a780e579d464d54e26d97d65dc327d2b2bdd92d47c4b8","sha512":"03fc5614f48fc9a2e3c4a30626fdbacde74c1fda09ffa9d1cde0393d31cd5fe1588e270c241f4cedb473c6e5cc224ff16c141468a29519ea6159accf3e3a18f1","ssdeep":"","tlshash":"a4c08c8350e2080c8210861b848880050b8808b04f9308a22cd85b7ecc9ae88c8f804c","size":148,"data":"","first_seen":"2023-03-07T01:10:06Z","last_seen":"2026-06-07T08:18:02.151537Z","times_seen":15899,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"console":null},"http":[{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-index-index~pages-user-index.283699af.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.358Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/js/pages-index-index~pages-user-index.283699af.js HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 23 Nov 2025 17:34:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692345b8-39ea\"\r\nexpires: Tue, 06 Jan 2026 17:37:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14826,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (14344), with no line terminators","md5":"6a2a419d4213902be96477453fcc4958","sha1":"0863c43ca382b1dae754ebd61a8dc149bdbde35a","sha256":"0155b2c35d5490594b654f191852095c9fa1f9889ea5e3fac5d0e2f44eabdb43","sha512":"d651a40e7b150fd3f1c0467429730b621907aa179277beb70337d595a12cca73cf5e5de9df07e69449469b7d56ba974cf58e1a96e9cbdb3afef5f47392d28285","ssdeep":"384:0kOl0unIln5is09t7gQFi/Z2ep6TfEgUX98:0kb+IJ5iN9t7gQFi/Zfp6DEJ8","tlshash":"7e62612db0c99cb73fd9a4c4406f600663de6a15cee17d02b77a8b858b7e249102ff64","first_seen":"2025-12-08T21:17:13.872246Z","last_seen":"2026-01-06T05:38:23.460588Z","times_seen":2,"resource_available":true,"data":null}},"time_used":309,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":309,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aa.jjxblhzi.top/index/apiindex/apihome","fqdn":"aa.jjxblhzi.top","domain":"jjxblhzi.top","tld":"top"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.709Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aa.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:55:01 GMT","end":"Tue, 10 Feb 2026 09:55:00 GMT"},"fingerprint":{"sha1":"E5:50:F3:A2:ED:56:4E:49:11:80:65:D9:26:A1:BA:31:6B:60:B3:F5","sha256":"A1:9D:C6:A2:16:04:A9:1C:D8:0F:DE:7F:4B:54:9D:FE:D6:C5:D7:67:DA:83:A9:F9:E2:5E:FA:B7:30:9D:36:D0"}}},"request":{"raw":"OPTIONS /index/apiindex/apihome HTTP/1.1\r\nHost: aa.jjxblhzi.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: lang\r\nReferer: https://neweex.cc/\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:56 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, GET, OPTIONS, DELETE, PUT\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization,Token,Lang\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":477,"timings":{"blocked":232,"dns":0,"connect":0,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"aa.jjxblhzi.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-login-index.38ba0cec.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.821Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/js/pages-login-index.38ba0cec.js HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 23 Nov 2025 17:34:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692345b8-59ed\"\r\nexpires: Tue, 06 Jan 2026 17:37:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23021,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (22439), with no line terminators","md5":"8f96c95b4794ce22f3c341162dc3f1ee","sha1":"13fcdfee07ebfd6218fcc30ba4a235b671376149","sha256":"53ece167a24cc90c1bc9282f30f4e73982103171769534cda22125f6041695c3","sha512":"bdef4d1976badfd521d4c4d216959728ebb15f3f38caca68b32981b249ef2922f387db40b0ccc31cec7267f8c72e4f6690e79c0fb1ea5a2819e95a8ee2683006","ssdeep":"384:Jp5nE77pf0et7gQFS4b3YTBGQeFRjjUXN:het7gQFbjF5E","tlshash":"45a2c61d70c99c7b3fd6a4d4002f2106239e5e548de2be42b7768b918bbe549212ff68","first_seen":"2025-12-08T21:17:13.87577Z","last_seen":"2026-01-06T05:38:23.465085Z","times_seen":2,"resource_available":true,"data":null}},"time_used":282,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":282,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aa.jjxblhzi.top/index/apilogin/apiindex","fqdn":"aa.jjxblhzi.top","domain":"jjxblhzi.top","tld":"top"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:57.234Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aa.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:55:01 GMT","end":"Tue, 10 Feb 2026 09:55:00 GMT"},"fingerprint":{"sha1":"E5:50:F3:A2:ED:56:4E:49:11:80:65:D9:26:A1:BA:31:6B:60:B3:F5","sha256":"A1:9D:C6:A2:16:04:A9:1C:D8:0F:DE:7F:4B:54:9D:FE:D6:C5:D7:67:DA:83:A9:F9:E2:5E:FA:B7:30:9D:36:D0"}}},"request":{"raw":"GET /index/apilogin/apiindex HTTP/1.1\r\nHost: aa.jjxblhzi.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nlang: en\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:57 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=cokuqtkmlppmnd4gc2ss3r9nlt; path=/\nthink_var=en-us; expires=Tue, 06-Jan-2026 06:37:57 GMT; Max-Age=3600; path=/\nserver_name_session=b44005567ca92386613d4662053ccd73; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6285,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"578e015ff511a58d33b19ffe20b365a1","sha1":"91d2c7f97ce6bcdb152333d63f048ab955513979","sha256":"a2c3686cc0a30d7b3ece3fc766564c348cf4e6a51a33a0c74511ccb58f38fd4b","sha512":"b6d8aebe27526fbf1a74ac1b55f2dab644ea17488ad0424e21c90b977c539b88537b6422d0cb7e0c08f36b3eb5778aa7570772a5b7532668ca8ffc8c4daaa80e","ssdeep":"192:u7k1RmKeGxRrBCn40CztVhAnFLrOB5N5hkZ0:u7kLeGxR6LnZrC5hkZ0","tlshash":"25d1e89eb7db076443e381e4af24cd6aeb6c67358143863198edc937c61727780bca15","first_seen":"2026-01-06T05:38:23.468143Z","last_seen":"2026-01-06T05:38:23.468143Z","times_seen":1,"resource_available":false,"data":null}},"time_used":311,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":311,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"aa.jjxblhzi.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aa.jjxblhzi.top/index/apiindex/apihome","fqdn":"aa.jjxblhzi.top","domain":"jjxblhzi.top","tld":"top"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:57.236Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aa.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:55:01 GMT","end":"Tue, 10 Feb 2026 09:55:00 GMT"},"fingerprint":{"sha1":"E5:50:F3:A2:ED:56:4E:49:11:80:65:D9:26:A1:BA:31:6B:60:B3:F5","sha256":"A1:9D:C6:A2:16:04:A9:1C:D8:0F:DE:7F:4B:54:9D:FE:D6:C5:D7:67:DA:83:A9:F9:E2:5E:FA:B7:30:9D:36:D0"}}},"request":{"raw":"GET /index/apiindex/apihome HTTP/1.1\r\nHost: aa.jjxblhzi.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nlang: en\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:57 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=45dp3rnnc7r3pdp33dcgrp26ea; path=/\nthink_var=en-us; expires=Tue, 06-Jan-2026 06:37:57 GMT; Max-Age=3600; path=/\nserver_name_session=b44005567ca92386613d4662053ccd73; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":39,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"48e1069f20aca87851d1171101fd9942","sha1":"c23efc0ab7d334dea6106abd923b82adddfbc0c9","sha256":"1e50198727217365e5ee6c5b2f4da11d9fbc4840ef5a26543d99c3a51c6e4afa","sha512":"67eef5c49d01f979afa6794394b1ff7d1e5f94bc97ed7e1a0699a810654cfc29f1e6f45334a4ecbb866fc738bfa668401463e14c5da1946570c920153cc8a1d9","ssdeep":"","tlshash":"189000200e0e002f20baa3ec380c230c80ebc2a2f0c08b302c0c03f0a028080a0022a2","first_seen":"2025-12-08T21:17:13.860106Z","last_seen":"2026-01-06T05:38:23.470856Z","times_seen":2,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"aa.jjxblhzi.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-01-06T05:37:53.652Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:54 GMT\r\ncontent-type: text/html\r\nlast-modified: Wed, 03 Dec 2025 04:58:06 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692fc35e-9e1\"\r\nset-cookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2529,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (2246)","md5":"72b6804a4ca3d3fdd1dbcf2f3c02f177","sha1":"949bdc945bd7a8616582661c76a31e97216efedd","sha256":"10cdd66bdc1781dab594be45a79d1559503cd74b930934e24677fbaecac02ff8","sha512":"90f87db27007d34070d253f40b04c9fd9cb2a779dff39e78685af4ebe96fce2338bb0d12096032ccc51f1625dc0f8f1183f1dc1641cba26c7012dd7f3a995a3f","ssdeep":"","tlshash":"f251778147b6f66c87c430d9b867cc1e417b0c19faf1e7d85c5adc909a9043af6198ab","first_seen":"2026-01-06T05:38:23.473609Z","last_seen":"2026-01-06T05:38:23.473609Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1352,"timings":{"blocked":551,"dns":49,"connect":246,"send":0,"wait":249,"receive":0,"ssl":253},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aa.jjxblhzi.top/index/apilogin/apiindex","fqdn":"aa.jjxblhzi.top","domain":"jjxblhzi.top","tld":"top"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.335Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aa.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:55:01 GMT","end":"Tue, 10 Feb 2026 09:55:00 GMT"},"fingerprint":{"sha1":"E5:50:F3:A2:ED:56:4E:49:11:80:65:D9:26:A1:BA:31:6B:60:B3:F5","sha256":"A1:9D:C6:A2:16:04:A9:1C:D8:0F:DE:7F:4B:54:9D:FE:D6:C5:D7:67:DA:83:A9:F9:E2:5E:FA:B7:30:9D:36:D0"}}},"request":{"raw":"OPTIONS /index/apilogin/apiindex HTTP/1.1\r\nHost: aa.jjxblhzi.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: lang\r\nReferer: https://neweex.cc/\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:56 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, GET, OPTIONS, DELETE, PUT\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization,Token,Lang\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":1456,"timings":{"blocked":606,"dns":106,"connect":245,"send":0,"wait":245,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"aa.jjxblhzi.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"at.alicdn.com/t/font_2266623_eio6sbh25vq.ttf?t=1608431886048","fqdn":"at.alicdn.com","domain":"alicdn.com","tld":"com"},"ip":{"addr":"47.246.44.178","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.364Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tbcdn.cn","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 16 Jun 2025 09:41:05 GMT","end":"Sat, 18 Jul 2026 09:41:04 GMT"},"fingerprint":{"sha1":"64:77:72:8B:BB:58:44:79:90:C3:B0:8D:35:BC:EC:6C:D6:35:BD:83","sha256":"3D:49:49:78:42:46:FF:F7:52:9B:6B:82:DF:7E:54:4B:F9:BA:D8:34:14:1D:21:67:63:4E:5B:62:A1:D8:85:B5"}}},"request":{"raw":"GET /t/font_2266623_eio6sbh25vq.ttf?t=1608431886048 HTTP/1.1\r\nHost: at.alicdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: Tengine\r\ncontent-type: application/octet-stream\r\ncontent-length: 9768\r\ndate: Wed, 12 Nov 2025 11:08:04 GMT\r\nx-oss-request-id: 69146A9414A30E38356D83B4\r\nvary: Origin\r\naccept-ranges: bytes\r\netag: \"E84BD838873A5D46CBF597A230D04F66\"\r\nlast-modified: Fri, 24 Dec 2021 21:06:46 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 11794027078388653495\r\nx-oss-storage-class: Standard\r\ncache-control: max-age=63072000\r\ncontent-md5: 6EvYOIc6XUbL9ZeiMNBPZg==\r\nx-oss-server-time: 5\r\nvia: ens-cache35.l2de4[0,0,200-0,H], ens-cache7.l2de4[1,0], ens-cache3.se2[0,0,200-0,H], ens-cache8.se2[2,0]\r\nage: 4732191\r\nali-swift-global-savetime: 1762945685\r\nx-cache: HIT TCP_HIT dirn:8:401065956\r\nx-swift-savetime: Wed, 19 Nov 2025 09:10:25 GMT\r\nx-swift-cachetime: 30506260\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\neagleid: 2ff62c9c17676778764172289e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":9768,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 11 tables, 1st \"GSUB\", 18 names, Macintosh,            ","md5":"e84bd838873a5d46cbf597a230d04f66","sha1":"0bdd0d8d4aae042327504df5b6eba0d54c8dcc21","sha256":"8159e6a8c91f4b999416ff75da0237c38f1f09c692816bf0afbccd7786ea1bfd","sha512":"15d25593413bdaf26af3819aa00abc6933d6671275cfccf12f092431b91b629faab73897d088e957077689852b4d95831184e7bf37b30a58ca3a5530cf075e51","ssdeep":"192:36rynfeec8DcLBMQjYoq1O4hpY1FkKmUGBEQhIrtfruuNU8k:K+fedTthl/RmUGBlqz5bk","tlshash":"6a124a06937dad6be08f4a794c5f15031ff5ea352a77e3c7a0882619cc521f80da0b9e","first_seen":"2025-12-08T21:17:13.864936Z","last_seen":"2026-03-04T15:02:41.016984Z","times_seen":3,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":90,"dns":35,"connect":7,"send":0,"wait":9,"receive":5,"ssl":44},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"aa.jjxblhzi.top/index/apilogin/apiindex","fqdn":"aa.jjxblhzi.top","domain":"jjxblhzi.top","tld":"top"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:57.117Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aa.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:55:01 GMT","end":"Tue, 10 Feb 2026 09:55:00 GMT"},"fingerprint":{"sha1":"E5:50:F3:A2:ED:56:4E:49:11:80:65:D9:26:A1:BA:31:6B:60:B3:F5","sha256":"A1:9D:C6:A2:16:04:A9:1C:D8:0F:DE:7F:4B:54:9D:FE:D6:C5:D7:67:DA:83:A9:F9:E2:5E:FA:B7:30:9D:36:D0"}}},"request":{"raw":"OPTIONS /index/apilogin/apiindex HTTP/1.1\r\nHost: aa.jjxblhzi.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: lang\r\nReferer: https://neweex.cc/\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:57 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, GET, OPTIONS, DELETE, PUT\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization,Token,Lang\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":280,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":279,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"aa.jjxblhzi.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aa.jjxblhzi.top/index/apilogin/apiindex","fqdn":"aa.jjxblhzi.top","domain":"jjxblhzi.top","tld":"top"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:57.399Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aa.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:55:01 GMT","end":"Tue, 10 Feb 2026 09:55:00 GMT"},"fingerprint":{"sha1":"E5:50:F3:A2:ED:56:4E:49:11:80:65:D9:26:A1:BA:31:6B:60:B3:F5","sha256":"A1:9D:C6:A2:16:04:A9:1C:D8:0F:DE:7F:4B:54:9D:FE:D6:C5:D7:67:DA:83:A9:F9:E2:5E:FA:B7:30:9D:36:D0"}}},"request":{"raw":"GET /index/apilogin/apiindex HTTP/1.1\r\nHost: aa.jjxblhzi.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nlang: de\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:57 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=jaiotghhnv2fqj801lloufpu3t; path=/\nthink_var=en-us; expires=Tue, 06-Jan-2026 06:37:57 GMT; Max-Age=3600; path=/\nserver_name_session=b44005567ca92386613d4662053ccd73; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":6285,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"578e015ff511a58d33b19ffe20b365a1","sha1":"91d2c7f97ce6bcdb152333d63f048ab955513979","sha256":"a2c3686cc0a30d7b3ece3fc766564c348cf4e6a51a33a0c74511ccb58f38fd4b","sha512":"b6d8aebe27526fbf1a74ac1b55f2dab644ea17488ad0424e21c90b977c539b88537b6422d0cb7e0c08f36b3eb5778aa7570772a5b7532668ca8ffc8c4daaa80e","ssdeep":"192:u7k1RmKeGxRrBCn40CztVhAnFLrOB5N5hkZ0:u7kLeGxR6LnZrC5hkZ0","tlshash":"25d1e89eb7db076443e381e4af24cd6aeb6c67358143863198edc937c61727780bca15","first_seen":"2026-01-06T05:38:23.468143Z","last_seen":"2026-01-06T05:38:23.468143Z","times_seen":1,"resource_available":false,"data":null}},"time_used":288,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":288,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"aa.jjxblhzi.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aa.jjxblhzi.top/index/apilogin/apiindex","fqdn":"aa.jjxblhzi.top","domain":"jjxblhzi.top","tld":"top"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:57.696Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aa.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:55:01 GMT","end":"Tue, 10 Feb 2026 09:55:00 GMT"},"fingerprint":{"sha1":"E5:50:F3:A2:ED:56:4E:49:11:80:65:D9:26:A1:BA:31:6B:60:B3:F5","sha256":"A1:9D:C6:A2:16:04:A9:1C:D8:0F:DE:7F:4B:54:9D:FE:D6:C5:D7:67:DA:83:A9:F9:E2:5E:FA:B7:30:9D:36:D0"}}},"request":{"raw":"OPTIONS /index/apilogin/apiindex HTTP/1.1\r\nHost: aa.jjxblhzi.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nAccess-Control-Request-Method: GET\r\nAccess-Control-Request-Headers: lang\r\nReferer: https://neweex.cc/\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:57 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 0\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST, GET, OPTIONS, DELETE, PUT\r\naccess-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization,Token,Lang\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/octet-stream","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-25T01:51:47.226353Z","times_seen":17518204,"resource_available":true,"data":null}},"time_used":266,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":266,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"aa.jjxblhzi.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-login-index~pages-login-reg~pages-user-add_bank~pages-user-moditypwd~pages-user-renzheng.2bf05296.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.819Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/js/pages-login-index~pages-login-reg~pages-user-add_bank~pages-user-moditypwd~pages-user-renzheng.2bf05296.js HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 03 Dec 2025 04:58:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692fc35f-7d18\"\r\nexpires: Tue, 06 Jan 2026 17:37:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32024,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (31976), with no line terminators","md5":"d73bb926b1649bf82bf46875bb668824","sha1":"92d38ed743d353ee838a935cc9b71eec183531e0","sha256":"5b778ac9a0e0f8867d9302081ee5197cbd1212a27d8c063a8dc8b8247c534382","sha512":"5764ab2897a7a7e207cd6aef2f191a01319a4437b50f8fa5ae7b95e449ed6d5c9dfccb06d8aebe3c8ba6f45e199e5cc5981a6f669e383b388d0b19cffdf3935d","ssdeep":"768:b43B35d9oK+BA2BcFL1eXleTHeu2e7xeuqeu5eubeuYeNseueeuweT+euqleuDuO:s3BTB+bBDjtdUi","tlshash":"dfe2d68c73ddb01e46d365e4601f100ba377b968581ae842e3f2a1e59eb175e0233fb9","first_seen":"2025-12-08T21:17:13.867963Z","last_seen":"2026-01-06T05:38:23.478343Z","times_seen":2,"resource_available":true,"data":null}},"time_used":273,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":273,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/index.ed4a2d2b.css","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:54.634Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/index.ed4a2d2b.css HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:54 GMT\r\ncontent-type: text/css\r\nlast-modified: Sun, 23 Nov 2025 17:34:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692345b8-1794e\"\r\nexpires: Tue, 06 Jan 2026 17:37:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96590,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"d2c05a28c7f2113821d909b7b5b918a3","sha1":"ccac94311f6ac6f580b64f47f7705318f1d226a3","sha256":"695bdbeea38a126c139158967cdd4f3a435e9936b9dff5b002e5f20a10fc7907","sha512":"3b96fbd1a89be8ae0b7479705cd4a2958ffe7f2f3f57ec23f407ad51ed8b447b9960728d77502e8fd8b2b19bf0971682030117559df250ea11c9bc1802364c3c","ssdeep":"1536:qlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nrhlvbc:hApuK7hmVrS1Wu3iG41nrPI","tlshash":"4493f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2025-10-16T12:28:28.877032Z","last_seen":"2026-07-24T04:54:18.332395Z","times_seen":1637,"resource_available":false,"data":null}},"time_used":518,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":518,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/index.dbbd0d59.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:54.636Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/js/index.dbbd0d59.js HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:54 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 03 Dec 2025 04:58:07 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692fc35f-49c6d\"\r\nexpires: Tue, 06 Jan 2026 17:37:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":302189,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (59384), with no line terminators","md5":"459110efe495b6d36a58faac60e0f0f7","sha1":"32c46f7369bfcd588273a9970eed7a581766f3e4","sha256":"2f34c7ae01b260cd89cb2b77e2f5b6827e76a723154b2c25c85ae512a59a8845","sha512":"565f4954d5d98eebac4c0dfad085fc5e523ab68c9e4c3ad6afe2d604f1337b987ca827a558aa1d32d381387e80e4229b80996ebd8da73d785eec9a8397becda8","ssdeep":"3072:WxwHt7KtKiNud2OUc5rJODe/aeK0IbfrMF9s93gYAiFqlvXsABAi/+jpfeDsbEJ8:iOdR8satjbfy9s93DFqRBMpfJAAih86K","tlshash":"c6546dd8bac96aaeead38c94d017d56573213d665007b493f3f2f984cbadbc49034728","first_seen":"2025-12-08T21:17:13.87759Z","last_seen":"2026-01-06T05:38:23.481533Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1076,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1076,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-index-index~pages-login-index~pages-login-reg~pages-recharge-index~pages-tard-index~pages-user~af2b1eb1.cc38aa65.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.355Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/js/pages-index-index~pages-login-index~pages-login-reg~pages-recharge-index~pages-tard-index~pages-user~af2b1eb1.cc38aa65.js HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 23 Nov 2025 17:34:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692345b8-4852\"\r\nexpires: Tue, 06 Jan 2026 17:37:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18514,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (18482), with no line terminators","md5":"3b07d33a6fa17610880b7a6cd17c3b39","sha1":"b9d0750e3534d86586cdbbbf15a4b54ad12d113f","sha256":"9fa045163f31567f26dda59088a1b1b75f044a1c28aa53f4e65ea99e5cfa4e8c","sha512":"3ab01378b499de4c067b64b6463c95ddd9fea77ba84d34f21e65f60cb096aaf360f7634bb3145d92821face8ee076a654c331e6b871a28d0c0fa8e3116e9f328","ssdeep":"192:dC/l3MOZfFWGT3cqR7eknRTeknycJMOFaPueDe+bxyZv4Lk5PiN9lgPl1+PEU1bA:dkR7ZfFWezR1MOUuWfbxyZvx1+sM0","tlshash":"39829559f08db51b0bd3cd28518fb50066653b87986076c8bbe2a9f08f576ad311af0b","first_seen":"2025-12-08T21:17:13.884737Z","last_seen":"2026-01-06T05:38:23.483473Z","times_seen":2,"resource_available":true,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-index-index.e22bdb81.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.359Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/js/pages-index-index.e22bdb81.js HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 23 Nov 2025 17:34:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692345b8-8ce8\"\r\nexpires: Tue, 06 Jan 2026 17:37:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":36072,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (35736), with no line terminators","md5":"4d0a048e19853a01e5aa16e125cf3827","sha1":"037f02298ad5ddcb65d190992e4c41216739619f","sha256":"946c5982412dfda3b5e91c53066c5a2b8e3f30cf3ae7cbc9d86e7e114e35891f","sha512":"a582110865e84c031e47474c7de47f8ea84e684139284591259bd03143d6f9d47f835f8c615e28ee3a60cf26fd19992cae8b434df941fbe82116cec20d6adec7","ssdeep":"768:y9jcK0Yab1KquA42VycxccZDUV2ON/mftb5FXhtxgZq1XtqRqhjP3:y9jZ0pRKvAPycxccZDUV2ON/qtbvXJgK","tlshash":"4af2e71df08eb41b8ad3a8a400df094950372d6a9515f294f7b6c6b0cfb718e2329f8d","first_seen":"2025-12-08T21:17:13.873916Z","last_seen":"2026-01-06T05:38:23.486345Z","times_seen":2,"resource_available":true,"data":null}},"time_used":320,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":320,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"at.alicdn.com/t/font_2225171_8kdcwk4po24.ttf","fqdn":"at.alicdn.com","domain":"alicdn.com","tld":"com"},"ip":{"addr":"47.246.44.178","port":443,"asn":24429,"as":"Zhejiang Taobao Network Co.,Ltd","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.798Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.tbcdn.cn","organization":"Alibaba (China) Technology Co., Ltd."},"issuer":{"commonName":"GlobalSign GCC R3 OV TLS CA 2024","organization":"GlobalSign nv-sa"},"validity":{"start":"Mon, 16 Jun 2025 09:41:05 GMT","end":"Sat, 18 Jul 2026 09:41:04 GMT"},"fingerprint":{"sha1":"64:77:72:8B:BB:58:44:79:90:C3:B0:8D:35:BC:EC:6C:D6:35:BD:83","sha256":"3D:49:49:78:42:46:FF:F7:52:9B:6B:82:DF:7E:54:4B:F9:BA:D8:34:14:1D:21:67:63:4E:5B:62:A1:D8:85:B5"}}},"request":{"raw":"GET /t/font_2225171_8kdcwk4po24.ttf HTTP/1.1\r\nHost: at.alicdn.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: Tengine\r\ncontent-type: application/octet-stream\r\ncontent-length: 55940\r\ndate: Mon, 05 Jan 2026 16:50:35 GMT\r\nx-oss-request-id: 695BEBDB585982393102ADCD\r\nvary: Origin\r\naccept-ranges: bytes\r\netag: \"B716002BF601F727176AE7901BDF4E4F\"\r\nlast-modified: Fri, 24 Dec 2021 20:51:06 GMT\r\nx-oss-object-type: Normal\r\nx-oss-hash-crc64ecma: 10201830100077572647\r\nx-oss-storage-class: Standard\r\ncache-control: max-age=63072000\r\ncontent-md5: txYAK/YB9ycXaueQG99OTw==\r\nx-oss-server-time: 1\r\nvia: ens-cache6.l2de4[0,0,200-0,H], ens-cache17.l2de4[1,0], ens-cache8.se2[29,28,200-0,M], ens-cache8.se2[32,0]\r\nage: 46041\r\nali-swift-global-savetime: 1767631835\r\nx-cache: MISS TCP_MISS dirn:-2:-2\r\nx-swift-savetime: Tue, 06 Jan 2026 05:37:56 GMT\r\nx-swift-cachetime: 31057959\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\neagleid: 2ff62c9c17676778767612553e\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Alibaba Cloud Object Storage Service","description":"Alibaba Cloud Object Storage Service (OSS) is a cloud-based object storage service provided by Alibaba Cloud, which allows users to store and access large amounts of data in the cloud.","website":"https://www.alibabacloud.com/product/object-storage-service","common_platform_enumeration":"","icon":"Alibaba Cloud.svg","categories":["IaaS"]},{"name":"Tengine","description":"Tengine is a web server which is based on the Nginx HTTP server.","website":"https://tengine.taobao.org","common_platform_enumeration":"","icon":"Tengine.png","categories":["Web servers"]}],"data":{"size":55940,"size_decoded":0,"mime_type":"application/octet-stream","magic":"TrueType Font data, 11 tables, 1st \"GSUB\", 18 names, Macintosh,            ","md5":"b716002bf601f727176ae7901bdf4e4f","sha1":"e87c1130c27fa42d822c198f5ea8b633b5118b94","sha256":"4bc8cc97559c0a52ea4f5ce0563e1bf3a7f89d660f74792e662e76d49eae4707","sha512":"cd4d86bc27a8055bf4ba21730991acb71e32d1d8c3176b6aada3c8fcfbaacfabe3cf1c813665b4434b16c757587d38afb8fd61f3a84a440053a96b545187e672","ssdeep":"768:00Yo6KrRwXJDv2mjQ5PMWCUPQnNqcoocj9MNb5+kYfcUFO++wEMjQYVEh/gG+VeV:xY1dCpj8+kYfcUUXwjjQYV8/gBVE","tlshash":"3c437c2b835e4fb3d16a86f90c4f011b5fefd7206636f99664ca5c1e4402afd085cb9a","first_seen":"2023-04-09T15:26:02Z","last_seen":"2026-07-20T06:04:17.523584Z","times_seen":3713,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":42,"receive":9,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/favicon.ico","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:57.415Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:57 GMT\r\ncontent-type: text/html\r\ncontent-length: 146\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":146,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"8eec510e57f5f732fd2cce73df7b73ef","sha1":"3c0af39ecb3753c5fee3b53d063c7286019eac3b","sha256":"55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0","sha512":"73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574","ssdeep":"","tlshash":"b7c02b2d35133c4cc563313423c37140c0d6833b687a41110400c00371cf2998ec3397","first_seen":"2023-03-07T12:05:15Z","last_seen":"2026-07-25T01:47:46.932095Z","times_seen":543562,"resource_available":true,"data":null}},"time_used":299,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":299,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"aa.jjxblhzi.top/index/apilogin/apiindex","fqdn":"aa.jjxblhzi.top","domain":"jjxblhzi.top","tld":"top"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:57.963Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"aa.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:55:01 GMT","end":"Tue, 10 Feb 2026 09:55:00 GMT"},"fingerprint":{"sha1":"E5:50:F3:A2:ED:56:4E:49:11:80:65:D9:26:A1:BA:31:6B:60:B3:F5","sha256":"A1:9D:C6:A2:16:04:A9:1C:D8:0F:DE:7F:4B:54:9D:FE:D6:C5:D7:67:DA:83:A9:F9:E2:5E:FA:B7:30:9D:36:D0"}}},"request":{"raw":"GET /index/apilogin/apiindex HTTP/1.1\r\nHost: aa.jjxblhzi.top\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nContent-Type: application/x-www-form-urlencoded\r\nlang: de\r\nOrigin: https://neweex.cc\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:58 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: *\r\naccess-control-allow-headers: *\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=8qeu8k7m3ki3nsmb9fh3t5k9nm; path=/\nthink_var=en-us; expires=Tue, 06-Jan-2026 06:37:58 GMT; Max-Age=3600; path=/\nserver_name_session=b44005567ca92386613d4662053ccd73; Max-Age=86400; httponly; path=/\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6285,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"JSON text data","md5":"578e015ff511a58d33b19ffe20b365a1","sha1":"91d2c7f97ce6bcdb152333d63f048ab955513979","sha256":"a2c3686cc0a30d7b3ece3fc766564c348cf4e6a51a33a0c74511ccb58f38fd4b","sha512":"b6d8aebe27526fbf1a74ac1b55f2dab644ea17488ad0424e21c90b977c539b88537b6422d0cb7e0c08f36b3eb5778aa7570772a5b7532668ca8ffc8c4daaa80e","ssdeep":"192:u7k1RmKeGxRrBCn40CztVhAnFLrOB5N5hkZ0:u7kLeGxR6LnZrC5hkZ0","tlshash":"25d1e89eb7db076443e381e4af24cd6aeb6c67358143863198edc937c61727780bca15","first_seen":"2026-01-06T05:38:23.468143Z","last_seen":"2026-01-06T05:38:23.468143Z","times_seen":1,"resource_available":false,"data":null}},"time_used":302,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":302,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"aa.jjxblhzi.top","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.222.174.117","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:58.233Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:58 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Tue, 06 Jan 2026 15:37:58 GMT\r\ncache-control: max-age=36000\r\nset-cookie: __uni__uid=rBEQa2lcn7a2N9/YA4ZUAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-07-25T01:33:01.32396Z","times_seen":17462,"resource_available":false,"data":null}},"time_used":1515,"timings":{"blocked":640,"dns":41,"connect":236,"send":0,"wait":235,"receive":0,"ssl":352},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-login-index~pages-login-reg~pages-recharge-index~pages-tard-index~pages-user-add_bank~pages-us~5444fab9.669dd9cb.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.815Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/js/pages-login-index~pages-login-reg~pages-recharge-index~pages-tard-index~pages-user-add_bank~pages-us~5444fab9.669dd9cb.js HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 23 Nov 2025 17:34:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692345b8-322c\"\r\nexpires: Tue, 06 Jan 2026 17:37:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12844,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (12828), with no line terminators","md5":"e1d74180242d57d0a017231981750a8a","sha1":"742529272ee84a9adfa504c342e15bccbc7011c2","sha256":"396be872ace10ea8ff6518ef9b2844819a0810a86585a10d0cc7c0b9d1a0ef54","sha512":"3da3ae9a75e11029def9c7c8cde2ded5b5c6d0660fb1a7da5f3fb540aa06ae2d10783b9fe681e481a30bae6c476f4a0617abab8639d4decb73c149dea34fe515","ssdeep":"192:b11sX3uYytVRl0Fka7tNWa+HFIZobYwcwEC0uBvjDLm2G0zzqD35qUN:b1eX6lv3lQgdzE35FN","tlshash":"e342932c708cf5c34ad3983061bb250792712a899c596590a7b5a2f447bfb8c1337f6e","first_seen":"2025-12-08T21:17:13.853417Z","last_seen":"2026-01-06T05:38:23.490219Z","times_seen":2,"resource_available":true,"data":null}},"time_used":252,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":252,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/chunk-vendors.16bdea55.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:54.635Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/js/chunk-vendors.16bdea55.js HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:54 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 23 Nov 2025 17:34:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692345b8-aac79\"\r\nexpires: Tue, 06 Jan 2026 17:37:54 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":699513,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (37683)","md5":"7dcb35824d856b15fa3be41f1fae6f52","sha1":"97a08107a166c96628d42fbdd3e4e92470ab2427","sha256":"a6b8beed602993e8dac36b5413cb5e5f36b7378c646e1dc642ce780c595a082b","sha512":"63dadd66595da2d325518e5f5c4b7cad897ebd52a3cc9101d493d2cb57a6decc8c621ffac1a5a7c519178d10d8925a9f1457aaf9a8251e8cbb36879f540d04cf","ssdeep":"6144:dcCMNkYaCGRDlzRpRrxbZhdjqphyI5GkFk1l9WP8Zy0sqO73bPB:ANShz3grGR1l0ck3bp","tlshash":"24e4089cf285b0a607e761f5003f220bb23b6968b40a94d9f275e4d4ad78d8e5137f78","first_seen":"2025-12-08T21:17:13.862731Z","last_seen":"2026-01-06T05:38:23.491932Z","times_seen":2,"resource_available":true,"data":null}},"time_used":559,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":559,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"neweex.cc/static/js/pages-index-index~pages-login-index~pages-login-reg~pages-order-index~pages-recharge-index~pages-tar~33f17ee8.9bb17b0b.js","fqdn":"neweex.cc","domain":"neweex.cc","tld":"cc"},"ip":{"addr":"45.192.212.39","port":443,"asn":0,"as":"","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://neweex.cc/","date":"2026-01-06T05:37:56.352Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"bb.jjxblhzi.top","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Nov 2025 09:54:20 GMT","end":"Tue, 10 Feb 2026 09:54:19 GMT"},"fingerprint":{"sha1":"6C:EC:36:D4:E7:FF:CA:3F:45:97:0D:F6:82:DD:7A:A6:EA:FD:23:FE","sha256":"B2:87:FC:82:E1:CE:B0:FF:E2:40:63:E2:FE:BB:13:B2:95:39:D9:95:9D:E0:6B:B5:41:1C:1F:68:06:7C:B1:64"}}},"request":{"raw":"GET /static/js/pages-index-index~pages-login-index~pages-login-reg~pages-order-index~pages-recharge-index~pages-tar~33f17ee8.9bb17b0b.js HTTP/1.1\r\nHost: neweex.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://neweex.cc/\r\nCookie: server_name_session=3a8ea1eba152474a72a76e90543e0ca3\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Tue, 06 Jan 2026 05:37:56 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Sun, 23 Nov 2025 17:34:48 GMT\r\nvary: Accept-Encoding\r\netag: W/\"692345b8-33aa\"\r\nexpires: Tue, 06 Jan 2026 17:37:56 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13226,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (13064), with no line terminators","md5":"0899ab94fa6eb0b20a25dff36d4d7458","sha1":"22dcf08912cbf0db7beea626709ce4141e145445","sha256":"3715a889311f9109d256f83daa323923226d0dc57bcaf61c6ae8d421a1085eeb","sha512":"3457be2e604f7ed63d6f39ae8ad71452c3cda8f46330ca71d110525c65ff2c2e07fb8446c66df96b14a6039b96699b13050246048cd8ef08da24de5908a940c4","ssdeep":"192:d9PB63uH7IrehKwJcDn3fj29EwogwgmJNIpGbl/V571Pi+AJ8k:d9P8I7eliHmMpW4D","tlshash":"e752b90db19df59b86c304b0502f2206a1623dbe6d29f953d7f286e44b3679e3122f6d","first_seen":"2025-12-08T21:17:13.879666Z","last_seen":"2026-01-06T05:38:23.493583Z","times_seen":2,"resource_available":true,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2026-01-06","alert":"Sinkholed","trigger":"neweex.cc","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}