{"report_id":"77b7f873-797c-4c18-88be-8b8978b98162","version":0,"status":"done","tags":[],"date":"2026-07-28T17:43:19Z","url":{"schema":"http","addr":"h5.ibitao.com","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":0,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"h5.ibitao.com/#/","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"title":"Bitinvests","dom":{"size":880201,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (53625)","md5":"c161089562008bbaeecc3e64892358d4","sha1":"6299904cde3ce4965f696a15929679d8015b8ce1","sha256":"819ba6b195a6fb1e07de4c601f832c3854c30aaf6bcd1d27793b5d31f7ebbb9f","sha512":"6eb2726ef9542de44b8ec8bb1185ab6c6041e2d5e810e023a074aab68469ec65f9bee36cdb1fe2492d92a13419461217edaefde7e4837c3bd308472137df4aed","ssdeep":"12288:sZdwG1ZAIkKDJ3bys5XrHeg05TAr3nFBWhx:sZdwG1ZAIkKDJ3bys5XrHeg05TinI","tlshash":"e8159be3b9c820089437c656c685b7bcb93fba9383525d97ab0677318f462c73b0951e","dom_hash":"domhash223c68b344bc8610b77a16c89e235745","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"h5.ibitao.com","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":0,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-01T17:43:19Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"h5.ibitao.com","ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"domain_registered":"2015-03-20","domain_rank":0,"first_seen":"2026-07-28T17:39:19.783345Z","last_seen":"2026-07-28T17:39:19.783345Z","alert_count":44,"request_count":44,"received_data":3522180,"sent_data":32129,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"msys.ibitao.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2015-03-20","domain_rank":0,"first_seen":"2026-07-28T17:39:19.780755Z","last_seen":"2026-07-28T17:39:19.780755Z","alert_count":0,"request_count":13,"received_data":0,"sent_data":7258,"comment":"","tags":null,"fingerprints":null},{"fqdn":"cdn.dcloud.net.cn","ip":{"addr":"124.222.174.117","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"domain_registered":"2013-07-17","domain_rank":296858,"first_seen":"2018-09-15T09:18:08Z","last_seen":"2026-07-24T17:44:02.835081Z","alert_count":0,"request_count":1,"received_data":577,"sent_data":548,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-borr~f5e31127.bc60d92b.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8561609e58681cbde869241fe1c40240","sha1":"610ae5f9a2afcd74b67f50035e08ddbc8b11d771","sha256":"256a2e7a9c840b6b9d23ec9b4b8b753e2e36ae53d1b2e1eb8c145d46b50f6897","sha512":"8f4e4c935865f7241981f22de0a788426d490a95dc2cff36d4c3ce3e0b629d4c2f34833c81b7623bca009a89de784765667d2c3eaa56c79311cc469d2b5f0ba3","ssdeep":"384:VGmzSk0iieRhBpPfoANf6QvKdSsbWK+8E49:Vn069f6QiEsb5","tlshash":"59431a83f5c8a0944567cfa19f413efc9e2aae638201ec52d843af364e975c7370a59d","size":60142,"data":"","first_seen":"2025-10-09T10:46:45.41612Z","last_seen":"2026-07-28T18:14:35.985555Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-common-register~pages-fund-assets~pages-fund-assets_record~pages-fund-fundTransfer~pages-fund-~3c16b7c0.55082df8.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c0cac26a408babb0adcc6eab3d47713e","sha1":"cf5b4d8277c60ed75130e8a5d9920993961fb818","sha256":"ff8988badc7155ecbbdf37d70a603738b16c7d07d46c3f45864de16155899331","sha512":"2e14278ac06958e9a5a39af55098b38c6b9233e9a3e62dabc13047a47d1d2a1d9a38f1b48f2fa419fa6b9a32340eae9b484ae6de097b30b337fc6c9c5be54ff6","ssdeep":"384:pvpTQ8K6+N4rhGLSNySoKX28oiGgbDvUjC:w4UZ8oipbDvU2","tlshash":"e653f8e2f5ce20144177e7019f4132f99a3baa6383a16862fca16f344f9e6c73d2651d","size":61252,"data":"","first_seen":"2025-10-09T10:46:45.446836Z","last_seen":"2026-07-28T18:14:35.969101Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/common/js/touch-emulator.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"178ba7db6232252a555ba6ff953756a8","sha1":"31129606e2c7e395a73184f30e81e835a424cdf5","sha256":"2968f310031c7a0c1d271836caa44aedaa28794289d14c577f0b17033e8c036d","sha512":"dea2f867ed3e1774320ea9494c9fd6fa24a7c7eeba27e50099530d3eabe196b6a34f70cfb7d0ac87aa5c70dcb5172d149de92da8af78725b6090952588041dbd","ssdeep":"96:L+vx+c5tJzNjX/wGiZ27oA2qMrttS7KDWom4RhvYahnT/TCKkTIT1/CoShwqhzcs:yvx+chzxItcKs+LmKk8TqhzwoEPq","tlshash":"1a32314f098a226204bb7329fb9e904af67e85a311012056fcbc5f653f72a758694ecd","size":11668,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-28T18:14:36.017766Z","times_seen":736,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"3d6b954dc2d01b7f947ffbdbc08419c4","sha1":"91b4d1da374271f3f7a26ace5bb5d9a18cc7833d","sha256":"33452930b33391ee5b905f55ea3d83da98c22f96e001002468f1230369567e4e","sha512":"0edd93b88ed4f3b4e519ecaf80b84a9226198637f31e617f182614a579969c77e65863f98bda78349defd5054b0de9daff0d03b9299fdf432a72ca1b28191074","ssdeep":"","tlshash":"bb6000c3c03303000c0033ff00c300f00000c0000000f3003cc3000330000c003c00cc","size":16,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-28T18:14:36.01834Z","times_seen":993,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"c7c2044589cd6c4afb8f708d8f4929ce","sha1":"0a1a91f258a6b31b5f24008bde88fe949fd00317","sha256":"20217fc70ebe327eee12ece90b2c8ad0e6f760234c316849f05b7e2a7d0ee931","sha512":"50894a9f5d6c19842e74141d8b09cfc2ed951ee4d75dd45343c8c9156064fabc2129acf0c4635cfba00be760064af9293e826d7df958097177d67e364bb11248","ssdeep":"","tlshash":"25c04cb4761959305659a22d7239e7d83dbb501130437547901c158d0cf4e945671ea9","size":159,"data":"","first_seen":"2023-03-07T12:06:42Z","last_seen":"2026-07-28T18:37:23.181568Z","times_seen":1437,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"d9e35f3565e98641c0174d284e8ddd26","sha1":"967e8443ce108fe2742f3ec46237a40560c67c35","sha256":"6fc1c4ed09be48bc1d695bba608ad0c9ff9a525edd88b1819bdf413e88960e82","sha512":"7b6ca8aea3dd9c4b83fda1914179c9957606363ee546540bdaa87d0ed099362681da51036c06bb3a8c6641946b69621d72154075f78b02b770ab1bddb3ac8a23","ssdeep":"","tlshash":"576000000000f00c00c0000c003000c000c0f00f000c0c303c0fcc00300000c0f3000c","size":14,"data":"","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-28T18:14:36.019517Z","times_seen":1557,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/chunk-vendors.981a152f.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"57ec8430aac65ef7a65672007f846557","sha1":"f4a41cf66147de10fd5edaff4a9051987912e4ae","sha256":"a9906cc46b1c33ca0331ab6973747fe53d3f81e95564933c50c75489063bc64f","sha512":"a8c293a62032a4582a06fabd7b5f15d93a2d4ecc270761e4962c8f3e170b889dfec783ff2d412ddbc79f9428ae971b5ff38da80fcb481eff0fd4310a97ca9932","ssdeep":"6144:XXM1sVCGJGqzF1aBP+WAhe1f56LVRO86wdPQ2EGnY4sqAF3jPP:M1SjzrV7BRB6sPcoc3jH","tlshash":"a1e4f79cb285b0b607e761f5003f220ba13b6968b40ad4d5f2b9e5d4ad78d8e5127f3c","size":688064,"data":"","first_seen":"2025-10-09T10:46:45.465341Z","last_seen":"2026-07-28T18:14:36.002418Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-common-borrowing~pages-common-borrowing_confirm~pages-common-forget~pages-common-login~pages-c~f11127ab.19549ae7.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"5ec13aefabd683cf0af3fda9c9d1ed79","sha1":"bd22fa9be5f2cedb16286883b56e3c4f7b4428fe","sha256":"86d8e5c92aba88311b71b660a34bb905b316f492e9965e8eb821a35d6c3d7dc5","sha512":"4f3ccfafa20b8fc1425a5049301b52c349e42108e01334ebed08dcc5dbbabf0e7fbfbb06e1ea95a330271998d18759472f483bbb0e2bd9e3654196629a700188","ssdeep":"768:lStwhFJikFxthjVvUglEuNva088WF7MjssX0g:ouhTikmkXT87sj","tlshash":"fdc32bc2fdc860048d6bd705954636fd9e2ffb630255acdafe812f384e2a1d726095ac","size":121497,"data":"","first_seen":"2025-10-09T10:46:45.429789Z","last_seen":"2026-07-28T18:14:35.982839Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-index-index.1da7811e.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"8b81848c433c98b775250cc1be712396","sha1":"f4d33c2b0c6190730a981330b79dff867b960ca0","sha256":"36f4df66b05f81c3603dc9c829adf24eed545a290ad2e12992ed057f22231bce","sha512":"afa2dcf22c03af647722f9259150a95e275e4dc7f1f8b2ef2f03265ee9139518681952b5280b3ee7bf7c211ab584a7b6aa1f7dea6654155a4d3980a20bf3cb44","ssdeep":"3072:r7PCEbnAP8oJc16WkPvY03ttOeSVseo2zw6t2jRj4CpUVJc1ZnkgdacVM2WrDqm3:ziv9sseo2jcRj4CXLdaejWh","tlshash":"71a463d3f6dc20088577d712e55676fc9e3faa739301a846e99a7f304f166ca3a0492c","size":480645,"data":"","first_seen":"2025-10-09T10:46:45.47109Z","last_seen":"2026-07-28T18:14:35.957337Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/index.b4974705.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2d88d3f4e47e1a859d2d8d018d98e8e0","sha1":"1d6b4718ee70f451298e17cc7af5935ba2118bb5","sha256":"4dd2d730fe54c5a875e38e56a88dbb8eb570639e28106641a16b5fee639d5676","sha512":"bd0e1e98710ff04614f543a82cc2a403ecc207a4e5474abe4874fb67619286f07667cebd1e3354cf0947c39b1fd7b5420d74ab84e4be185561e2f1db43e4b9bd","ssdeep":"24576:uPBE9SKM+9XCGEKGZquYZdwG1ZAIkKDJ3bys5XrHeg05TFL:uPBEsKD9XSKGZqun","tlshash":"28657d5374c8913821d34601a18b322852bddd3b6643f8e8ffc95614dbdb6b97326b3a","size":1494122,"data":"","first_seen":"2026-07-28T17:39:23.588331Z","last_seen":"2026-07-28T18:14:36.02041Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-borr~66ab8cc6.42ed42b3.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"b52f306914ec65142095af6c1e12ae9b","sha1":"1fe5779db0fc3baa55170270510c5238deaf0f0e","sha256":"e83686ec014cfd1856dcb5c81f7554e6614365f9afc64b799cf7cea51fecb3d4","sha512":"cd5c8104d82ebb23ae58770da6ff29741b5705a1e2385f4af4bb596d6ef9d4ac0fb4dadd797ff67b306f2a59dba802fd1b81047cf0f0f64b857f067d7e990131","ssdeep":"768:LoFbYDUgQnKb6QWm4AmCd0tG8e+W1MAbu7N8ChEAh8sd0Q2Z7wX20tWNjZ1zztpr:LoFbzsYId0FHoMqu7NdEAaM2OpEjGrDo","tlshash":"4db3ddd2f6cc2840566fcf4e9341b3fcbbbaba2342697867e4622f244f772d62504558","size":109029,"data":"","first_seen":"2025-10-09T10:46:45.437049Z","last_seen":"2026-07-28T18:14:36.003219Z","times_seen":9,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"h5.ibitao.com/api/news/list","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.305Z","timestamp":1785260564305,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"POST /api/news/list HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\nOrigin: https://h5.ibitao.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":14,"data":"c_id=4\u0026lang=en"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\nset-cookie: angela_session=eyJpdiI6IldYZjROV25pb2xnWGNnN2F5blZqZXc9PSIsInZhbHVlIjoiY3NERllwQ3YwdkkrWVJDRzB1QndEYVZvVFM0MGR0ZlBjOGc1d1FXMVMwNW5nMHFGQ25CcWc3YTZ6VURlNHFHbzdHZG9MMGZXcVJCNHJ6Rk9NSUpTQUZjZkpIV0dyRVVTYU5iMXZtaXR6NmN5ZlBxdDBoZ1BOMjdQc1JSRkFXcWkiLCJtYWMiOiI4NDUyMTEwYmJjNjNlZGJlZTFiY2E1YmUyMWQ2ZGY5N2ZkNzlmMzYzNWJhMWIwOGU2NzNiNDk0ZTYzYjU2MGY4In0%3D; expires=Tue, 28-Jul-2026 19:42:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3562,"size_decoded":2156,"mime_type":"application/json","magic":"JSON text data","md5":"d9e434064faa81e0aaf4e13b7db6ff1c","sha1":"de362c342a7383708c1546791f332ccdf1fd6bfe","sha256":"3001cf46eb929d201b8b411e626f2a27e012a89913e57e3bac0c737c50b9f2c2","sha512":"3786341b17e2b11b88eb6171ef1260c967aaebf621c751cdd63817b9fa6bf610517099040c0a5d01cb5ff261cbf09b5b887f15160b7bd5311333108d180e5d5a","ssdeep":"","tlshash":"6771321cd65002f3d0544594b67f29fe4ea93bd4e3430aae11cc8aac75cb6ad2b768c7","first_seen":"2025-10-09T10:46:45.401596Z","last_seen":"2026-07-28T18:14:35.945315Z","times_seen":9,"resource_available":false,"data":null}},"time_used":304,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/icon/home-nav-6.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.657Z","timestamp":1785260564657,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/icon/home-nav-6.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-5f8\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1528,"size_decoded":1902,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"cb4e264a521f85622ab88f52b76bbb86","sha1":"721f032974a4a3edb6f3aeddadc4bdba715c52dd","sha256":"ec2dcb1b53b40794f11befcc436b88e806d72d675434ad0f691be6ed67e8aac1","sha512":"a2a36aa923a4a09ff3e349c629a6011f865a6aeb062feb98cb5883988279072e65e182a883cd5022d2a7bb6d38371a535ef7340b73c72bd6ab9eb1228b767958","ssdeep":"","tlshash":"fe31fc5f7321f53e5bbc972489c00d64b6f724bd6b17476a3b0124b426464ceee32545","first_seen":"2025-03-21T10:38:29.389222Z","last_seen":"2026-07-28T18:14:35.967244Z","times_seen":39,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"msys.ibitao.com//upload/1740513184711702.jpg","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.676Z","timestamp":1785260564676,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET //upload/1740513184711702.jpg HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"wss://msys.ibitao.com/socket.io/?EIO=3\u0026transport=websocket","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:45.194Z","timestamp":1785260565194,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://h5.ibitao.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: TrsLEBRvrf70duxENeoZVA==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-index-index.1da7811e.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.963Z","timestamp":1785260563963,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/js/pages-index-index.1da7811e.js HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-75585\"\r\nexpires: Wed, 29 Jul 2026 05:42:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":480645,"size_decoded":130538,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65358), with no line terminators","md5":"8b81848c433c98b775250cc1be712396","sha1":"f4d33c2b0c6190730a981330b79dff867b960ca0","sha256":"36f4df66b05f81c3603dc9c829adf24eed545a290ad2e12992ed057f22231bce","sha512":"afa2dcf22c03af647722f9259150a95e275e4dc7f1f8b2ef2f03265ee9139518681952b5280b3ee7bf7c211ab584a7b6aa1f7dea6654155a4d3980a20bf3cb44","ssdeep":"3072:r7PCEbnAP8oJc16WkPvY03ttOeSVseo2zw6t2jRj4CpUVJc1ZnkgdacVM2WrDqm3:ziv9sseo2jcRj4CXLdaejWh","tlshash":"71a463d3f6dc20088577d712e55676fc9e3faa739301a846e99a7f304f166ca3a0492c","first_seen":"2025-10-09T10:46:45.47109Z","last_seen":"2026-07-28T18:14:35.957337Z","times_seen":9,"resource_available":true,"data":null}},"time_used":172,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":172,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/api/news/list","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.309Z","timestamp":1785260564309,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"POST /api/news/list HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\nOrigin: https://h5.ibitao.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":14,"data":"c_id=5\u0026lang=en"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\nset-cookie: angela_session=eyJpdiI6IlwvWDVGQlJienZhU2RFRXpkSjh0WFJnPT0iLCJ2YWx1ZSI6ImIyZDNGd1dyZFg4VVNzUWZcL1lWNDBFdWdmaVpPZ0xyV0djZFFBUTg3cVRzVVdocnJiRlA5d0MyeHY5NXJaUFpsZFZTcXhYcnRVdkNzZHNoTUVSOFVBVkxUa2NyOGVBY1FqYUdreVZmYzhZbFd1aFdUWnR4RW9wS1N6Y1wvZVVhNTAiLCJtYWMiOiIwNzFhZjFjM2EwZmZjOTJiYWZiNTU4MTVkMDkzYWUwN2RjNTk2ZjgxNGZmNWFjZjA3OTAxMGJmNzcxNWIxN2VlIn0%3D; expires=Tue, 28-Jul-2026 19:42:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2092,"size_decoded":1473,"mime_type":"application/json","magic":"JSON text data","md5":"4b7ed01e8f1c75fd1f3416886fbafa38","sha1":"7ce3adcaeecafc67f98d743824ea439ee620ea2b","sha256":"fceb935749346f67ab61e758e0e4fd486a141398352e3b9f46b4d0be6bb93d21","sha512":"80a3620124d2e31189ecc19cb8a40cbf4af82a7487624aaf6549b118c900277d0d9283987b2b80c487d4b0bb84f41eaa34a433e109c8671b9f64aafe89598e83","ssdeep":"","tlshash":"fa41de2eda95c57ae3dd31c6585bb25e6bdc9202c3410b5836948ec881ee2c7dc1b7a8","first_seen":"2025-10-09T10:46:45.461918Z","last_seen":"2026-07-28T18:14:35.946001Z","times_seen":9,"resource_available":false,"data":null}},"time_used":304,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":304,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/img/headimage.504f68d5.svg","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.358Z","timestamp":1785260564358,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/img/headimage.504f68d5.svg HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-571\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1393,"size_decoded":837,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"504f68d512d68cc6b6823d1c10dd00b3","sha1":"ef7421b5e2a335523b5315d87b70014de2ab7dcf","sha256":"033d8a4d2dbb6efc16f9d1c595f93ac5f78861ea913461f46c9da86a59301829","sha512":"e4c47163d2caaccbc66d9c821945510be53ce5ab27683eff4199792353c62bd79b050897ff26cfd5a6f55d0f19b364e3dc361bbc2e4e5d38807631e9212ff146","ssdeep":"","tlshash":"b1214ba134f9890e86354ac5efeb6ac9953df3db931b05c8b24870275f31099358f256","first_seen":"2024-08-19T23:01:21.442574Z","last_seen":"2026-07-28T18:14:36.015727Z","times_seen":69,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/index/BTC.svg","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.912Z","timestamp":1785260564912,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/index/BTC.svg HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6InE0ekp5R1NLcG5sTmF5VTR2ejc4cGc9PSIsInZhbHVlIjoiYnVSaitsVU9QSlVQdmYxODR1UERhcW43akM3MU96UU9KQWtaZHlUak5CUDFvNlV1RU5sR0FyQlJrcVhHc25JWkNZTXc4cGJWN0VkNmFqZHVlVGFwZ2FjUUVhREtHaEFzOVB4aUd5U2xNNmlSb0dHR2Q1bWpiMU9xK2ZhZUlISlgiLCJtYWMiOiI4ODM0NTVmYmU5OWE5ZTgwMGMyNjNkNzc2ZjYyN2Y5OTU3Y2M2Mjg3YTYyZGU5MzFjZTkyYWE3N2JjNDJkMzg4In0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/svg+xml\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-5d9\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1497,"size_decoded":1085,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b8d46e3eec195d8aecc3d74425b407f8","sha1":"17230ffb2a2d5e46de0fcbcef0648ca937adf8d7","sha256":"c53be737fbc08dde80489d60cbba0f2501605976374d979fbd5fa0e98caddf2e","sha512":"c850aa8594cbeb5c2fd9e6e1a55b4266b14bf5367fe8051344d9def56a7c0c84449cba604205678f464ccf0223f05042e6c97ac64316ed599d3e4705fb39b243","ssdeep":"","tlshash":"bb3165ff9704e2acdf86c0beef39d894521ba49a766714d18dee4a2c01075c3b506e94","first_seen":"2024-08-19T23:01:21.44338Z","last_seen":"2026-07-28T18:14:35.977554Z","times_seen":73,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://msys.ibitao.com/socket.io/?EIO=3\u0026transport=websocket","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:53.767Z","timestamp":1785260573767,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://h5.ibitao.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: vjNA4VuRZytx5Jn0A3HRng==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/common/js/touch-emulator.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:42.600Z","timestamp":1785260562600,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/common/js/touch-emulator.js HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-2d94\"\r\nexpires: Wed, 29 Jul 2026 05:42:42 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11668,"size_decoded":3408,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"178ba7db6232252a555ba6ff953756a8","sha1":"31129606e2c7e395a73184f30e81e835a424cdf5","sha256":"2968f310031c7a0c1d271836caa44aedaa28794289d14c577f0b17033e8c036d","sha512":"dea2f867ed3e1774320ea9494c9fd6fa24a7c7eeba27e50099530d3eabe196b6a34f70cfb7d0ac87aa5c70dcb5172d149de92da8af78725b6090952588041dbd","ssdeep":"96:L+vx+c5tJzNjX/wGiZ27oA2qMrttS7KDWom4RhvYahnT/TCKkTIT1/CoShwqhzcs:yvx+chzxItcKs+LmKk8TqhzwoEPq","tlshash":"1a32314f098a226204bb7329fb9e904af67e85a311012056fcbc5f653f72a758694ecd","first_seen":"2023-03-07T14:41:52Z","last_seen":"2026-07-28T18:14:36.017766Z","times_seen":736,"resource_available":true,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":161,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://msys.ibitao.com/socket.io/?EIO=3\u0026transport=websocket","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.980Z","timestamp":1785260563980,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://h5.ibitao.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: FEWdtMctGLZCurCYIvA3HA==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/nav/nav-2.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.986Z","timestamp":1785260563986,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/nav/nav-2.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-487\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1159,"size_decoded":1533,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"933780d27ef2b9bce4a294cf50f0dbf3","sha1":"109a5de921006c295958ee0cf37332a2db8b788b","sha256":"a4218348cd0090a8e1a7843cb93d952610f6003097484977bc39b90eaa647f31","sha512":"088df5efeb5a4f760723cf01d080892b8a0df9a7a4ac43f0913cd7c5c3f013aa9f1be82d8905bcc26f2bedc8b52e26c50ec51d137e54c7398a10d1cb0c5f8157","ssdeep":"","tlshash":"5421d7f0209a3cf6ed9c0511f2829086b9f812aa29975a264d74183ba85a3ccd801b4e","first_seen":"2024-08-19T23:01:21.42129Z","last_seen":"2026-07-28T18:14:35.958001Z","times_seen":102,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":168,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-borr~66ab8cc6.42ed42b3.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.956Z","timestamp":1785260563956,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-borr~66ab8cc6.42ed42b3.js HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-1a9e5\"\r\nexpires: Wed, 29 Jul 2026 05:42:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":109029,"size_decoded":38805,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65272), with no line terminators","md5":"b52f306914ec65142095af6c1e12ae9b","sha1":"1fe5779db0fc3baa55170270510c5238deaf0f0e","sha256":"e83686ec014cfd1856dcb5c81f7554e6614365f9afc64b799cf7cea51fecb3d4","sha512":"cd5c8104d82ebb23ae58770da6ff29741b5705a1e2385f4af4bb596d6ef9d4ac0fb4dadd797ff67b306f2a59dba802fd1b81047cf0f0f64b857f067d7e990131","ssdeep":"768:LoFbYDUgQnKb6QWm4AmCd0tG8e+W1MAbu7N8ChEAh8sd0Q2Z7wX20tWNjZ1zztpr:LoFbzsYId0FHoMqu7NdEAaM2OpEjGrDo","tlshash":"4db3ddd2f6cc2840566fcf4e9341b3fcbbbaba2342697867e4622f244f772d62504558","first_seen":"2025-10-09T10:46:45.437049Z","last_seen":"2026-07-28T18:14:36.003219Z","times_seen":9,"resource_available":true,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/index.b4974705.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:42.608Z","timestamp":1785260562608,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/js/index.b4974705.js HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Thu, 11 Jun 2026 16:13:11 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a2ade97-16cc6a\"\r\nexpires: Wed, 29 Jul 2026 05:42:42 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1494122,"size_decoded":413868,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (56343), with no line terminators","md5":"79ea11bf9583ce2c533d3e7778a386b2","sha1":"58af2243da01f6295ca4ec1d3dcb2f75349b638e","sha256":"edce661cf0b8873e158691c8fc0a444ee3a06320160d50745a875802aa5a1cc3","sha512":"82ebf1230cacddc5a3d7501152bcac9851427ae06e23920729c9bb44d26498fe0da09d47aa47199b6f025dab3619904710d2d5af474e7c36f214cb869be4f3df","ssdeep":"12288:My93rgPExD2AHONLsBh9ygKVUBPOAwSPqlGYYk9U9X7Y2CDHiEwPUiTTp3:uPBE9SKM+9XCGH","tlshash":"6b35495474cda63521e3a141618b711451bded3f858bf428ffca8214eb8f9b8b32ab35","first_seen":"2026-07-28T17:43:24.03548Z","last_seen":"2026-07-28T18:14:35.981995Z","times_seen":3,"resource_available":false,"data":null}},"time_used":641,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":641,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/img/notify.7457eaf5.svg","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.633Z","timestamp":1785260564633,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/img/notify.7457eaf5.svg HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 232\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\netag: \"67bd4edf-e8\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":232,"size_decoded":503,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7457eaf536494ae5a62ac5a29ef73bf6","sha1":"954d9bd34e7a267796abff8813f3ef09bba893f1","sha256":"3c4f6e001108845fa863675de268ca0c05fb4a9c3031201050821e8f07ab737e","sha512":"cb9a56cd4484e4de95f5375b64bb9256cbd40f0f3511198bde409778292d5cca8cb380be315dc4a112e8a9ff0616861457324bbc55270cb8f5a013cd55ef873e","ssdeep":"","tlshash":"7fd0a765c3580d2cb5614730ff34b374107571d5160c5069d8612071e2149ae78379e8","first_seen":"2025-08-02T22:37:01.27165Z","last_seen":"2026-07-28T18:14:35.961431Z","times_seen":36,"resource_available":false,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/icon/home-nav-3.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.653Z","timestamp":1785260564653,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/icon/home-nav-3.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-693\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1683,"size_decoded":2057,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"9558a3efaf4cd039cbc756a673b8dc53","sha1":"3027a81b700341c0d47becc08966b757f2bbfea5","sha256":"77a21a245ebbfe498d4bd31fb7af74408269c5a7ff1f3cb3fd1a4a09ee627e3f","sha512":"a89576251f6e2433809772db9f6f219f53d8d5bc2f3ee95d118f3335076cc68a2414da2f3760132ff28cb3360fd7a7e74bc3e1474b7a1c3dccee4570ef5dfe38","ssdeep":"","tlshash":"4a3118eaec2098be8d0fdcb860db355de79d5000f8a6c554d0c6fda60a22e681cdb312","first_seen":"2025-03-21T10:38:29.387943Z","last_seen":"2026-07-28T18:14:35.984791Z","times_seen":27,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/index/LTC.svg","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.918Z","timestamp":1785260564918,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/index/LTC.svg HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6InE0ekp5R1NLcG5sTmF5VTR2ejc4cGc9PSIsInZhbHVlIjoiYnVSaitsVU9QSlVQdmYxODR1UERhcW43akM3MU96UU9KQWtaZHlUak5CUDFvNlV1RU5sR0FyQlJrcVhHc25JWkNZTXc4cGJWN0VkNmFqZHVlVGFwZ2FjUUVhREtHaEFzOVB4aUd5U2xNNmlSb0dHR2Q1bWpiMU9xK2ZhZUlISlgiLCJtYWMiOiI4ODM0NTVmYmU5OWE5ZTgwMGMyNjNkNzc2ZjYyN2Y5OTU3Y2M2Mjg3YTYyZGU5MzFjZTkyYWE3N2JjNDJkMzg4In0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 782\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\netag: \"67bd4edf-30e\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":782,"size_decoded":1054,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"65fd45dfae31cfa4f0d4b460ccd1a3e3","sha1":"8de783717c8228b98481989ab4a06079c13d94d3","sha256":"1fec6683e9a5d1d49aa9f1c8f71795545939789e5b5e8bfeac889d24288e5e0d","sha512":"692400cdbb041553b7977499796d24598b8fd20c02bfe3d76b3af10ec7f61e8027252c2183b1c3fdfaba9667b2ae9de76404bfa4915d2e9ddb82967517028985","ssdeep":"","tlshash":"c901f17ae25c206dce528799df359011632ea8d976566097d6cc2f34521aad3e003dc0","first_seen":"2025-09-17T18:10:57.084521Z","last_seen":"2026-07-28T18:14:36.012685Z","times_seen":69,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://msys.ibitao.com/socket.io/?EIO=3\u0026transport=websocket","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:43:15.909Z","timestamp":1785260595909,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://h5.ibitao.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: QBqg4ncAcCSlajexg+7Wow==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/chunk-vendors.981a152f.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:42.606Z","timestamp":1785260562606,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/js/chunk-vendors.981a152f.js HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:42 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-a7fc0\"\r\nexpires: Wed, 29 Jul 2026 05:42:42 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":688064,"size_decoded":216647,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65527), with no line terminators","md5":"57ec8430aac65ef7a65672007f846557","sha1":"f4a41cf66147de10fd5edaff4a9051987912e4ae","sha256":"a9906cc46b1c33ca0331ab6973747fe53d3f81e95564933c50c75489063bc64f","sha512":"a8c293a62032a4582a06fabd7b5f15d93a2d4ecc270761e4962c8f3e170b889dfec783ff2d412ddbc79f9428ae971b5ff38da80fcb481eff0fd4310a97ca9932","ssdeep":"6144:XXM1sVCGJGqzF1aBP+WAhe1f56LVRO86wdPQ2EGnY4sqAF3jPP:M1SjzrV7BRB6sPcoc3jH","tlshash":"a1e4f79cb285b0b607e761f5003f220ba13b6968b40ad4d5f2b9e5d4ad78d8e5127f3c","first_seen":"2025-10-09T10:46:45.465341Z","last_seen":"2026-07-28T18:14:36.002418Z","times_seen":9,"resource_available":true,"data":null}},"time_used":475,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":475,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/api/news/index_pop?lang=en","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.312Z","timestamp":1785260564312,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /api/news/index_pop?lang=en HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\nset-cookie: angela_session=eyJpdiI6Ik5TZ0lHbFwvc3RvV25SVHJ1NmN5NGZ3PT0iLCJ2YWx1ZSI6IkhsT2dBSml5UGlFMjhBaXZLaGd5QmYwc2FJYTlxV1wvN1RVSjRjMmZYendFQjVpZVBUdGlOZk1QN3RPOW10YW91dm5odlwvejRFXC9wVmZXTFlXTzJ1ck1tTWw3OWJXSFczM1ZJZUNVNm80cWFNMWNRR0U5ZTN2SWFSaHNXNWZFdks1IiwibWFjIjoiZDczZjYzYWY4ZDg3N2E1Njg0MTcyMDE5YWUwZDJlOTlkZGQ2OTg0YzJkYzI5ZDQ3OTBhODNjMDhiNmIyYjgzYSJ9; expires=Tue, 28-Jul-2026 19:42:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28,"size_decoded":940,"mime_type":"application/json","magic":"JSON text data","md5":"7e6fa1bf5cc93ff191f6e9d25a7b5587","sha1":"027ba2ef0614fec58e260e7a0c989c283527b30b","sha256":"4fda09bb7c83ec6f6948f56849c4f7cb727c29cdeb0b42b84bec891be728a963","sha512":"4953f0c097793c2f756ea0eb744cac4369bb3cabad68f180964c481216bd4b77a9c176b1c4c0c81caf6df74bf5c8bb91f14c7b3aa4caee30131c6811ca9a5e0d","ssdeep":"","tlshash":"4b800000a208ac28030a0a0238883800828e0083c0822a0208088e28838e8b0223232e","first_seen":"2023-11-01T08:36:58Z","last_seen":"2026-07-28T18:14:35.975494Z","times_seen":294,"resource_available":false,"data":null}},"time_used":296,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":296,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/iconfont/iconfont.woff2","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.382Z","timestamp":1785260564382,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/iconfont/iconfont.woff2 HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 32744\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\netag: \"67bd4edf-7fe8\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":32744,"size_decoded":33016,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 32744, version 1.0","md5":"5b8f35b173333c5161098c675e902401","sha1":"c33837d28eff55458d49ef00e68ae9a04da46f05","sha256":"912327f77b1b2d3092e0cda25efdd0c5045ef17d018864d1cefba33db7727fce","sha512":"38a8b9a82c69376f1664e4e76f31605a6ad31e611e2f282c46a40044624072a48ed8f9fd49735136afbd21ba61cc9ac9795828e6fcb33ad4b662bd41cf6b4084","ssdeep":"768:9P1NcXcebJOUlU8WQKAfiDvCcj+IWL3OJ:9dNcXceNOUSD3AfmCcfJ","tlshash":"cee2f1303175ab40c3e6ef396e7b1c46d8724a3892785ee1e3d16e4d142bccd19d5a2b","first_seen":"2023-05-20T12:09:29Z","last_seen":"2026-07-28T18:14:36.001743Z","times_seen":445,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/icon/home-nav-7.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.658Z","timestamp":1785260564658,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/icon/home-nav-7.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-735\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1845,"size_decoded":2214,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"42f3e697f4570b05223d673a6c617ebd","sha1":"b60bc926ed6fd5dbc1fd452f5757b017803a2df8","sha256":"2ca4375a1d9c248cad2f534b50746948976ac628a57b3485f3bce4239ce5bd1d","sha512":"5fa9c988b0941851a54379fcb3454246982fbcf1729744424e101bd3babd05ba6384f08883037b647030af8b40d6528cf4f13cfc54f2c82a377c4aaaee885a08","ssdeep":"","tlshash":"3131f9fc179a71bf8a91ad6a84f019c4fffae671482cdc927199b316052d988ca1a131","first_seen":"2025-10-09T10:46:45.435343Z","last_seen":"2026-07-28T18:14:35.950009Z","times_seen":9,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://msys.ibitao.com/socket.io/?EIO=3\u0026transport=websocket","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:43:04.798Z","timestamp":1785260584798,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://h5.ibitao.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: vbetMpOE+ZdJlyGL0i5mzw==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"msys.ibitao.com//upload/1710529227106390.jpg","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.674Z","timestamp":1785260564674,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET //upload/1710529227106390.jpg HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.dcloud.net.cn/img/shadow-grey.png","fqdn":"cdn.dcloud.net.cn","domain":"dcloud.net.cn","tld":"net.cn"},"ip":{"addr":"124.222.174.117","port":443,"asn":45090,"as":"Shenzhen Tencent Computer Systems Company Limited","country":"China","country_code":"CN"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:45.969Z","timestamp":1785260565969,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.dcloud.net.cn","organization":""},"issuer":{"commonName":"Certum Domain Validation CA SHA2","organization":"Unizeto Technologies S.A."},"validity":{"start":"Tue, 26 Aug 2025 11:47:17 GMT","end":"Fri, 25 Sep 2026 11:47:16 GMT"},"fingerprint":{"sha1":"47:A7:6C:09:6B:1D:CA:2D:7D:39:2E:C1:7F:15:DE:5D:F2:C4:0F:77","sha256":"EA:73:37:83:D0:38:44:D9:3C:0B:26:F0:DD:D1:22:2F:36:F7:F2:86:A1:B0:58:52:DE:4E:0A:21:D6:89:E7:3E"}}},"request":{"raw":"GET /img/shadow-grey.png HTTP/1.1\r\nHost: cdn.dcloud.net.cn\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 136\r\nlast-modified: Thu, 06 Jun 2019 06:42:07 GMT\r\netag: \"5cf8b5bf-88\"\r\nexpires: Wed, 29 Jul 2026 15:42:46 GMT\r\ncache-control: max-age=79200\r\nset-cookie: __uni__uid=rBEQa2po6hac/xWFA3yPAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=dcloud.net.cn; path=/; secure; httponly; samesite=none\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":136,"size_decoded":577,"mime_type":"image/png","magic":"PNG image data, 1 x 6, 4-bit colormap, non-interlaced","md5":"5a962adf74d92ae702467b3f47976547","sha1":"36f74049375584e3fa69b5ef87e9572336ff9e7a","sha256":"ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f","sha512":"4ace23fe7ec6c7271710030fd423aace13eafac68ac3e76366ce4ce9bdc702caf71c9bdc2fb6a32c8e9791546098617cc0259decd8bb8489afdbce43e1b53a73","ssdeep":"","tlshash":"47c09bf3a615dc754a0d153b42e98271f429511e07046d0e5a13c216741e3448d56793","first_seen":"2023-04-15T10:50:30Z","last_seen":"2026-07-28T23:18:00.133008Z","times_seen":18357,"resource_available":false,"data":null}},"time_used":607,"timings":{"blocked":0,"dns":4,"connect":209,"send":0,"wait":195,"receive":0,"ssl":199},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/icon/home-nav-5.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.656Z","timestamp":1785260564656,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/icon/home-nav-5.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-716\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1814,"size_decoded":2183,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"bfbbe1e8a8f707280b0fb4c2cf6e5f0f","sha1":"e084b16775ff946356b436a574995debcb31d651","sha256":"738dba39d0a7c1635d60bf098f6f8f8b57498aec8f901c3c50f47a2e0e693ca3","sha512":"a4f9d3f5384ebd8da0e323920eda32149760ff40adfc31d637f3e0c5db03c97570d513269ed028f5d4647d47b4ff451de6f321a191929ffc92a1af102737273e","ssdeep":"","tlshash":"e631d788f770d1aa4e808af319e6fc16c62af0657151b768a9b84ce96410a0db684927","first_seen":"2025-03-21T10:38:29.368818Z","last_seen":"2026-07-28T18:14:35.949133Z","times_seen":35,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-common-borrowing~pages-common-borrowing_confirm~pages-common-forget~pages-common-login~pages-c~f11127ab.19549ae7.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.960Z","timestamp":1785260563960,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/js/pages-common-borrowing~pages-common-borrowing_confirm~pages-common-forget~pages-common-login~pages-c~f11127ab.19549ae7.js HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-1da99\"\r\nexpires: Wed, 29 Jul 2026 05:42:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":121497,"size_decoded":18950,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (65180), with no line terminators","md5":"5ec13aefabd683cf0af3fda9c9d1ed79","sha1":"bd22fa9be5f2cedb16286883b56e3c4f7b4428fe","sha256":"86d8e5c92aba88311b71b660a34bb905b316f492e9965e8eb821a35d6c3d7dc5","sha512":"4f3ccfafa20b8fc1425a5049301b52c349e42108e01334ebed08dcc5dbbabf0e7fbfbb06e1ea95a330271998d18759472f483bbb0e2bd9e3654196629a700188","ssdeep":"768:lStwhFJikFxthjVvUglEuNva088WF7MjssX0g:ouhTikmkXT87sj","tlshash":"fdc32bc2fdc860048d6bd705954636fd9e2ffb630255acdafe812f384e2a1d726095ac","first_seen":"2025-10-09T10:46:45.429789Z","last_seen":"2026-07-28T18:14:35.982839Z","times_seen":9,"resource_available":true,"data":null}},"time_used":169,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":169,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/nav/nav-4.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.990Z","timestamp":1785260563990,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/nav/nav-4.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\ncontent-length: 671\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\netag: \"67bd4edf-29f\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":671,"size_decoded":1011,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"20ff9596cb4a66c199bbee5820d20792","sha1":"a7073d844240cb0b89ba137270814f3cd7435cf8","sha256":"c559d98fe8b54b4e7ec4d52e1a226a2e93e82fc2c9fa0e2303b76a723116b54f","sha512":"74845930f97f753f8bf256015e08b28a1dc70778f5af9b8b119fb74a92eef610914f68031e2b014988b392fbe93b62f58cec0eeb57eea4a38d6201411690bb98","ssdeep":"","tlshash":"8f01889f3cd83d12cb449e3c2f0354dc60d81bb058816bc521fa3216181dadc00ac0d5","first_seen":"2024-08-19T23:01:21.423293Z","last_seen":"2026-07-28T18:14:35.974643Z","times_seen":95,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/logo.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.288Z","timestamp":1785260564288,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/logo.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-5b06\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23302,"size_decoded":23649,"mime_type":"image/png","magic":"PNG image data, 206 x 206, 8-bit/color RGBA, non-interlaced","md5":"9f947306d55f2c550e071c665c64c6ad","sha1":"ca9cdd2f81a3626610ef988b76ae1f688b44528f","sha256":"6f5901afe9771dc8f25e469771957ed8216fc7ef61c41ddd8062071a973b1f0d","sha512":"a9abe693cda87a668a79a51f170d8db7857a7287feab81990abb05f9dbe16c2a807565802843cf10d3d536fa56bd5844f55a889b063b5bf6bba6eb3cf75556e2","ssdeep":"384:H9MF9pYdZhlU94fM/CKV2SLDIhLErvdeT0Op7wRt//b3kBicTioXrG9y:HD7o4WCKV2SLDIAkI2W5qWoXV","tlshash":"66a2e0adb42a2f56d2b478a5deacf0560e960424a149e5c1170fe4fc3cac0b625e5ecd","first_seen":"2025-10-09T10:46:45.423816Z","last_seen":"2026-07-28T18:14:35.965952Z","times_seen":9,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/icon/home-nav-21.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.652Z","timestamp":1785260564652,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/icon/home-nav-21.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-6a4\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1700,"size_decoded":2074,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"35f3a608745c78905467d21192bdf3fe","sha1":"4f45906a7f1dc35188541dbae233c8da5af65466","sha256":"7464fe5ce8aaf5f9f645df597607c162664f915df5c3da1428bef2eff2b62aab","sha512":"a7db6ee6ef407e600fae8d11d873e0036af8274ca9b44e7bc81e3c735ea5c34194b41eefee3f8f465f55c073d3fd2ed10ef0c05607ea3f369bd0c614eb41ff0d","ssdeep":"","tlshash":"e631f8e41512a4f3a95a28ed526b869269ba2404f400b05ddc397f4c0f3ed030f5eb60","first_seen":"2025-03-21T10:38:29.386313Z","last_seen":"2026-07-28T18:14:36.016476Z","times_seen":35,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/icon/home-nav-4.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.654Z","timestamp":1785260564654,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/icon/home-nav-4.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-6af\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1711,"size_decoded":2085,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"a4376dcd7fcd106ec2e038576248c162","sha1":"8e3cff772291e69f3873b8758936472daab41948","sha256":"ad6685e9055923c7856e5b7c8bfc2a4e9d849e9f16d39af224e359173d3ce9dc","sha512":"fd3ee05a76d6e44fcab04b8ea6660d41fb9e892a9258350c5e9c0a7d99845b5ab317e0e2af62f47c0515e96ebfad1716ae40492ec45d7ed89beb1fd9478f2392","ssdeep":"","tlshash":"3531f8fbce297879aa1f97c56a76b4c4ba0f644779800310d8275629e46132e451105d","first_seen":"2025-03-21T10:38:29.371818Z","last_seen":"2026-07-28T18:14:35.980097Z","times_seen":30,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://msys.ibitao.com/socket.io/?EIO=3\u0026transport=websocket","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:48.266Z","timestamp":1785260568266,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://h5.ibitao.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: yqXtmT2rfbPHyI4uz4C7TQ==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-common-register~pages-fund-assets~pages-fund-assets_record~pages-fund-fundTransfer~pages-fund-~3c16b7c0.55082df8.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.961Z","timestamp":1785260563961,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/js/pages-common-register~pages-fund-assets~pages-fund-assets_record~pages-fund-fundTransfer~pages-fund-~3c16b7c0.55082df8.js HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-ef44\"\r\nexpires: Wed, 29 Jul 2026 05:42:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61252,"size_decoded":10326,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (61074), with no line terminators","md5":"c0cac26a408babb0adcc6eab3d47713e","sha1":"cf5b4d8277c60ed75130e8a5d9920993961fb818","sha256":"ff8988badc7155ecbbdf37d70a603738b16c7d07d46c3f45864de16155899331","sha512":"2e14278ac06958e9a5a39af55098b38c6b9233e9a3e62dabc13047a47d1d2a1d9a38f1b48f2fa419fa6b9a32340eae9b484ae6de097b30b337fc6c9c5be54ff6","ssdeep":"384:pvpTQ8K6+N4rhGLSNySoKX28oiGgbDvUjC:w4UZ8oipbDvU2","tlshash":"e653f8e2f5ce20144177e7019f4132f99a3baa6383a16862fca16f344f9e6c73d2651d","first_seen":"2025-10-09T10:46:45.446836Z","last_seen":"2026-07-28T18:14:35.969101Z","times_seen":9,"resource_available":true,"data":null}},"time_used":170,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/nav/nav-1-active.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.984Z","timestamp":1785260563984,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/nav/nav-1-active.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-581\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1409,"size_decoded":1783,"mime_type":"image/png","magic":"PNG image data, 52 x 52, 8-bit/color RGBA, non-interlaced","md5":"b47f232106cf02ac4d9a8ffea79df208","sha1":"42048a19f9466a2ca1e368390a707ea683522a56","sha256":"ea9f5bf25822c632884124254cdf311a76f42a7afe45056f129d8c8ba2bb5f8d","sha512":"54da2f269a8590b5f509338bba06830de9b73775549ac9840a3bf9bfcac588f9dd8ee7aec3913db9db26ced836d6a95f68ab60c0d0c6e2217c6eca370aec81e7","ssdeep":"","tlshash":"c0210bf7eefea60e16ab06bb22277875d425b98160314f761005c42b2b2014122184b9","first_seen":"2024-08-19T23:01:21.419072Z","last_seen":"2026-07-28T18:14:36.014389Z","times_seen":100,"resource_available":false,"data":null}},"time_used":170,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/api/news/list","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.319Z","timestamp":1785260564319,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"POST /api/news/list HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\nOrigin: https://h5.ibitao.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":14,"data":"c_id=5\u0026lang=en"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\nset-cookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D; expires=Tue, 28-Jul-2026 19:42:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2092,"size_decoded":1469,"mime_type":"application/json","magic":"JSON text data","md5":"4b7ed01e8f1c75fd1f3416886fbafa38","sha1":"7ce3adcaeecafc67f98d743824ea439ee620ea2b","sha256":"fceb935749346f67ab61e758e0e4fd486a141398352e3b9f46b4d0be6bb93d21","sha512":"80a3620124d2e31189ecc19cb8a40cbf4af82a7487624aaf6549b118c900277d0d9283987b2b80c487d4b0bb84f41eaa34a433e109c8671b9f64aafe89598e83","ssdeep":"","tlshash":"fa41de2eda95c57ae3dd31c6585bb25e6bdc9202c3410b5836948ec881ee2c7dc1b7a8","first_seen":"2025-10-09T10:46:45.461918Z","last_seen":"2026-07-28T18:14:35.946001Z","times_seen":9,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/api/lh/deposit/config?lang=en","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.322Z","timestamp":1785260564322,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /api/lh/deposit/config?lang=en HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\naccess-control-allow-origin: *, *\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization, Origin, Content-Type, Cookie, X-CSRF-TOKEN, Accept, Authorization, X-XSRF-TOKEN\r\naccess-control-expose-headers: Authorization, authenticated\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE, GET, POST, PATCH, PUT, OPTIONS\r\naccess-control-allow-credentials: false\r\nx-ratelimit-limit: 60\r\nx-ratelimit-remaining: 59\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1991,"size_decoded":1072,"mime_type":"application/json","magic":"JSON text data","md5":"9091e8f1707c3f89b89a38cb513003a5","sha1":"f4e150f01b27f6c7d26ed1c78b01a38839c16137","sha256":"c7b187a86793c7894f35987b674e286b89a52680239ee52916fa1f9ecdddfdb4","sha512":"12f01be619337bbb854dc4610b6b7c741a705b91367ed66ae91981f6155b4a1d491aaee1736d4f4a08effed3b189216a985443dd10e8888217ee2f28372d87eb","ssdeep":"","tlshash":"3641eba9622dcbf0c079768127d6749ca0e53b9e78c309c427debc5d87c5132e20ae72","first_seen":"2025-10-09T10:46:45.44414Z","last_seen":"2026-07-28T18:14:35.98627Z","times_seen":9,"resource_available":false,"data":null}},"time_used":292,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":292,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"msys.ibitao.com//upload/1680111685570675.png","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.678Z","timestamp":1785260564678,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET //upload/1680111685570675.png HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"wss","addr":"wss://msys.ibitao.com/socket.io/?EIO=3\u0026transport=websocket","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:59.303Z","timestamp":1785260579303,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://h5.ibitao.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: dVyTY4kololMPOwQ8lvbRg==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/api/getSiteConfig?lang=en","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.973Z","timestamp":1785260563973,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /api/getSiteConfig?lang=en HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\nset-cookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D; expires=Tue, 28-Jul-2026 19:42:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":835,"size_decoded":1287,"mime_type":"application/json","magic":"JSON text data","md5":"eff4e6ad8953b5e9455cf53c88779a11","sha1":"b966d6efed236a7024dc06699651dfea09b0f973","sha256":"0c6d380b0a67dcb413251d21de6cdd3787735ec9315476965caf17ffb0c22805","sha512":"b8f5a80fb10c5a90436160beffa042db177c3d1ded0c3d75df3f9116916ea3f2c42e54eabf8dbe96bc4a20e1246a770e8c29ed8e30c5b38f734ea2254222994e","ssdeep":"","tlshash":"43012b1d114bc94a97a3e1e959cf9504b79f3733c454ad4f47d8acdc81a82e9064d20f","first_seen":"2026-07-28T17:39:23.582832Z","last_seen":"2026-07-28T18:14:35.970541Z","times_seen":5,"resource_available":false,"data":null}},"time_used":303,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":303,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/logo.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.289Z","timestamp":1785260564289,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/logo.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-5b06\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23302,"size_decoded":23649,"mime_type":"image/png","magic":"PNG image data, 206 x 206, 8-bit/color RGBA, non-interlaced","md5":"9f947306d55f2c550e071c665c64c6ad","sha1":"ca9cdd2f81a3626610ef988b76ae1f688b44528f","sha256":"6f5901afe9771dc8f25e469771957ed8216fc7ef61c41ddd8062071a973b1f0d","sha512":"a9abe693cda87a668a79a51f170d8db7857a7287feab81990abb05f9dbe16c2a807565802843cf10d3d536fa56bd5844f55a889b063b5bf6bba6eb3cf75556e2","ssdeep":"384:H9MF9pYdZhlU94fM/CKV2SLDIhLErvdeT0Op7wRt//b3kBicTioXrG9y:HD7o4WCKV2SLDIAkI2W5qWoXV","tlshash":"66a2e0adb42a2f56d2b478a5deacf0560e960424a149e5c1170fe4fc3cac0b625e5ecd","first_seen":"2025-10-09T10:46:45.423816Z","last_seen":"2026-07-28T18:14:35.965952Z","times_seen":9,"resource_available":false,"data":null}},"time_used":163,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/api/menu?lang=en","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.313Z","timestamp":1785260564313,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /api/menu?lang=en HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\nset-cookie: angela_session=eyJpdiI6Imh0WWFORllaMENGUzVvdjVDYU9SMEE9PSIsInZhbHVlIjoiYmgxbGpCanJFZzJLQ0FIZnVxTWNQWGQ2bTFYUUdDMTVPSGMzSW1oZEFZb1RTd0poVWtOK3pNM1wvbjhzOE51UEdsdzNVcEJpVFwvS3lGYzk5OVduazJlb3ZZSEhRTE5MV3RJT0pwSFhoN3BSVWZMbHJxNHUzQjNCcFVSTE5RaUxKbSIsIm1hYyI6IjNhYTNmZWYzMzczOTRjYWQ4YTVkMjg1Y2EzZjNiNmQwMTQyMjY1ZGQyNWUxZjUwYjQ4OGUyYjk4MTQ4ZGEwOTQifQ%3D%3D; expires=Tue, 28-Jul-2026 19:42:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1160,"size_decoded":1280,"mime_type":"application/json","magic":"JSON text data","md5":"b170bfd884d34cf21d66493ca72d5584","sha1":"603c7086411389da2bd00a120b19f5b90c3d4751","sha256":"d0211fe11f39a8785696a461dce3b36c30f21bea1af7d8370f8e21f4204b38f0","sha512":"049380594f158a3e63c4160e0f5556f5f3f3800562c5b3ccdde534239a9d2ef908fed8e18df4d288bf6efe452a442d452baa66cd7f4e2325a0f3fe4357b6fcd1","ssdeep":"","tlshash":"b1219eed4ef83c2dd2fb22f168e3155e20960507dde4b99516efaddc02e818183db491","first_seen":"2026-07-28T17:39:23.553732Z","last_seen":"2026-07-28T18:14:35.983894Z","times_seen":5,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/api/menu?lang=en","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.316Z","timestamp":1785260564316,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /api/menu?lang=en HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\nset-cookie: angela_session=eyJpdiI6ImkwMmx0TlVsalNQOFdBbnJtQzdRclE9PSIsInZhbHVlIjoiMUVVUVBNRWZOcDJqR2hpY0laSVBVWHhrRDdTc2pzYmRNNTh3XC9DZHlKd0g3YVltUm5tc2hONUZpQlRkWWViT1ArRWVycW9rV2pmekkzUzJ3SElJdzF2ZUxTc0xReUpzMVVIS2szdExRUGtNa0NuaTRUT1VDclJkZWZcL21zTENMRyIsIm1hYyI6IjE0ZDNhODM0MjUyZjRlMjM4NGY0NTM3NWZlMTczMzM1ODM4ZjA5OWNiZGFjYTM1YTA1MmQ1NjY4MzQ5M2M1NzUifQ%3D%3D; expires=Tue, 28-Jul-2026 19:42:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1160,"size_decoded":1280,"mime_type":"application/json","magic":"JSON text data","md5":"b170bfd884d34cf21d66493ca72d5584","sha1":"603c7086411389da2bd00a120b19f5b90c3d4751","sha256":"d0211fe11f39a8785696a461dce3b36c30f21bea1af7d8370f8e21f4204b38f0","sha512":"049380594f158a3e63c4160e0f5556f5f3f3800562c5b3ccdde534239a9d2ef908fed8e18df4d288bf6efe452a442d452baa66cd7f4e2325a0f3fe4357b6fcd1","ssdeep":"","tlshash":"b1219eed4ef83c2dd2fb22f168e3155e20960507dde4b99516efaddc02e818183db491","first_seen":"2026-07-28T17:39:23.553732Z","last_seen":"2026-07-28T18:14:35.983894Z","times_seen":5,"resource_available":false,"data":null}},"time_used":295,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":295,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/index/EOS.svg","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.920Z","timestamp":1785260564920,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/index/EOS.svg HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6InE0ekp5R1NLcG5sTmF5VTR2ejc4cGc9PSIsInZhbHVlIjoiYnVSaitsVU9QSlVQdmYxODR1UERhcW43akM3MU96UU9KQWtaZHlUak5CUDFvNlV1RU5sR0FyQlJrcVhHc25JWkNZTXc4cGJWN0VkNmFqZHVlVGFwZ2FjUUVhREtHaEFzOVB4aUd5U2xNNmlSb0dHR2Q1bWpiMU9xK2ZhZUlISlgiLCJtYWMiOiI4ODM0NTVmYmU5OWE5ZTgwMGMyNjNkNzc2ZjYyN2Y5OTU3Y2M2Mjg3YTYyZGU5MzFjZTkyYWE3N2JjNDJkMzg4In0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 864\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\netag: \"67bd4edf-360\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":864,"size_decoded":1136,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"93ffad5eb7ca27db091af556477af44a","sha1":"88ec28dc6e4d823fed853f79c127e55d4e439274","sha256":"ef4d039ff2d7f7577321b1fe8fbdb229f879f4364c49129165f8f4bc6522fc89","sha512":"b5baae66dd5b7c8f9723dc3210da244dc0eefc1c2ed759bb5f3983c8f12f8076456bf27b542e7cef2af229c915f705ff31c65ce8c1b72fa081ac4e8e2bfc1876","ssdeep":"","tlshash":"df1123bfd31c112cd07f47b6db261492232fb1f9b6044092a88c6b6821152e3c947c90","first_seen":"2025-09-17T18:10:57.069249Z","last_seen":"2026-07-28T18:14:36.013592Z","times_seen":47,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/DIN-Regular.ttf","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.971Z","timestamp":1785260563971,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/DIN-Regular.ttf HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/octet-stream\r\ncontent-length: 24676\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\netag: \"67bd4edf-6064\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":24676,"size_decoded":24962,"mime_type":"application/octet-stream","magic":"TrueType Font data, 15 tables, 1st \"FFTM\", 14 names, Macintosh","md5":"1e0b91dcb4ed262d0c603006919a1fd8","sha1":"aa0cecebc344f5a3bbd614ab97a42ff8f8637d46","sha256":"4749fb5068ba31c2cba31bf6c7340977fc21cf0e9339bdf155dd57457cfc9e0d","sha512":"dc5635a9a7a8f0b3b454de6c1cd56bd22d16310a18b874f153a38bdecaf41dad5eea2405f3e092d9040f9278d37cc5163dba32f3478f91d7a6a348f4ee708bd8","ssdeep":"384:9iJk3F9sakdL5E5P/y5QJ0FNpmuJqJgkJhBZ5JeJMz1vHJb90KILamCKwL/plOLz:9JmdlAn2/pm6cBpJX2sdX4","tlshash":"9db27c0957424b0fc7277e308e2642a2d725fcb427fa9bdb9d44d8f7606d2e34c68a45","first_seen":"2023-04-17T17:59:29Z","last_seen":"2026-07-28T18:14:35.974021Z","times_seen":545,"resource_available":false,"data":null}},"time_used":182,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":182,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/icon/home-nav-8.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.659Z","timestamp":1785260564659,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/icon/home-nav-8.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-95f\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2399,"size_decoded":2773,"mime_type":"image/png","magic":"PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced","md5":"00b7132d1161255209159bedc62bc32f","sha1":"86f185ba0b6e5323e97559f78bcb6267258e7e8b","sha256":"65dfb75c7677c914d8f4abf158334e6126c69aff3eb651f785c2991f840ed930","sha512":"c557e0a9360be82633c19b9b6e7b0e901dc40d2430ab8863ec08221e05b1627ceb6030dcc73f551fae98f497ba2a78ac93083c4b0d5f5c909c9d9087dbdd09f6","ssdeep":"","tlshash":"45415bba2b0510693a71019e1fe845d1bd173487f4e335a6d9a7d8560ef34a03ac76b3","first_seen":"2025-08-02T22:37:01.295409Z","last_seen":"2026-07-28T18:14:35.968351Z","times_seen":29,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/index/XRP.svg","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.917Z","timestamp":1785260564917,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/index/XRP.svg HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6InE0ekp5R1NLcG5sTmF5VTR2ejc4cGc9PSIsInZhbHVlIjoiYnVSaitsVU9QSlVQdmYxODR1UERhcW43akM3MU96UU9KQWtaZHlUak5CUDFvNlV1RU5sR0FyQlJrcVhHc25JWkNZTXc4cGJWN0VkNmFqZHVlVGFwZ2FjUUVhREtHaEFzOVB4aUd5U2xNNmlSb0dHR2Q1bWpiMU9xK2ZhZUlISlgiLCJtYWMiOiI4ODM0NTVmYmU5OWE5ZTgwMGMyNjNkNzc2ZjYyN2Y5OTU3Y2M2Mjg3YTYyZGU5MzFjZTkyYWE3N2JjNDJkMzg4In0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 789\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\netag: \"67bd4edf-315\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":789,"size_decoded":1061,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"b3f937a8684cdbce2f2115978c5f87d9","sha1":"06fed4e916f8e337e917c70536f94462d90a1d75","sha256":"9729421eb11762302d733816ba8df6d377784dbffe422fa9caaa8a3b3ecc66af","sha512":"851e2a2bb0f35caa2002d180db02b18f6b15268a649ac8797be0d83e7475c22cf0d7670d248cf5d2f29c99e24b72e02d9a813820295ddd16d2c96606b94f1eb6","ssdeep":"","tlshash":"7b01c9fbe30d289ed4138a78f9296052e31fb0ed760941a3a64c2e2481726fbd843d84","first_seen":"2025-09-17T18:10:57.050414Z","last_seen":"2026-07-28T18:14:36.01719Z","times_seen":71,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/index.css","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:42.605Z","timestamp":1785260562605,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/index.css HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:42 GMT\r\ncontent-type: text/css\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-178f9\"\r\nexpires: Wed, 29 Jul 2026 05:42:42 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":96505,"size_decoded":26826,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"73ae6c583d02d78f81e3f18860a2899a","sha1":"07df9233fc11dddc34fbf519b891d40b2ac29c0f","sha256":"e97de9a247807f12d74101e9f736250b2410be4e1ed3d17ed875e4b08cf66c83","sha512":"da54ba9dbe06d8d763f3cfd64cf5babb54e761e3208c7a2f23e845290c48db8c115bb86c24262cd6c9a96ff2e51674c6d86439e1814baf2de7980f5c06349921","ssdeep":"1536:OlIApuK7hmVmb2RS1Wu3xdynGJ7eh/nKhlvbc:VApuK7hmVrS1Wu3iG41nKPI","tlshash":"1893f73719012e39e52bcd26b6c1ab5a1e61c033e15307adfba47628cbcf9c9167b345","first_seen":"2024-01-02T00:07:11Z","last_seen":"2026-07-28T21:23:38.50257Z","times_seen":6392,"resource_available":false,"data":null}},"time_used":316,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":316,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/api/news/list","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.317Z","timestamp":1785260564317,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"POST /api/news/list HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\nOrigin: https://h5.ibitao.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":14,"data":"c_id=4\u0026lang=en"}},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\nset-cookie: angela_session=eyJpdiI6ImhuVmFDNkNoXC9Jd3N1R0h4d1NQa09BPT0iLCJ2YWx1ZSI6IjdlbXlucENTNEdsRGVJQTdndnBqeEoyVFM1OHNCVVc3V3hOOGxaQ1Y3aXR6UlhaSkUrR0I0WE4wbyswYlZvXC9CNHhScXR5ZDdPVFwvS1hOUldVXC9hN2MzQjUrbGFJTk5Cc0pcL2toZWEyMHNxXC9GeVpaRTRwaTh1ZlBURjBpa0NDMXYiLCJtYWMiOiJiZDFiZGI4ZTVmZDc3Y2EwNWY2MGU0NGVhNmJiNTA4Yjk5ZWE2OWVhN2VjYzdhZDJmZTRlNDk3M2E0M2E5NTU2In0%3D; expires=Tue, 28-Jul-2026 19:42:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3562,"size_decoded":2164,"mime_type":"application/json","magic":"JSON text data","md5":"d9e434064faa81e0aaf4e13b7db6ff1c","sha1":"de362c342a7383708c1546791f332ccdf1fd6bfe","sha256":"3001cf46eb929d201b8b411e626f2a27e012a89913e57e3bac0c737c50b9f2c2","sha512":"3786341b17e2b11b88eb6171ef1260c967aaebf621c751cdd63817b9fa6bf610517099040c0a5d01cb5ff261cbf09b5b887f15160b7bd5311333108d180e5d5a","ssdeep":"","tlshash":"6771321cd65002f3d0544594b67f29fe4ea93bd4e3430aae11cc8aac75cb6ad2b768c7","first_seen":"2025-10-09T10:46:45.401596Z","last_seen":"2026-07-28T18:14:35.945315Z","times_seen":9,"resource_available":false,"data":null}},"time_used":298,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":298,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/icon/ljl.2d8170b7.gif","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.631Z","timestamp":1785260564631,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/icon/ljl.2d8170b7.gif HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IjNIQVFSaTlqdDhIQWJKVndLMGt2c0E9PSIsInZhbHVlIjoiZTQzODc0MXRYalRYZFRYQTRLcFFnTWNkb1YrOE9uQjR5ZmJYM0tvNTNtNFV5QjI4VnM2TVNyWjIwajQza2wyMjg1UDVueHlKZFlxOExKTXhUbHhJWlRMUG9aQ2V3OVdWRE1RampCTm14Y2E3WjNJeVZYU011SXhVNjFIRHdRNXoiLCJtYWMiOiI4ODMyM2IxZmE0MDA3NGE4MDU1YWZiNTAwMjI1MjVjM2M4OTI5MjIxNWI3MTQyZGY0ODFmNTM0NWQ3ODQ5NzZiIn0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/gif\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-30dfa\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":200186,"size_decoded":157798,"mime_type":"image/gif","magic":"GIF image data, version 89a, 280 x 280","md5":"2d8170b77a0ac72d0b496d3d79e52e29","sha1":"e2511a50ccf392931b5ef6cf5c6c261da82614c9","sha256":"67d1b5c342d43814875d3272e36ca67ce81fbcad7692200b8f1a7c66442e8fdc","sha512":"56325526d68b5d4eeb06c43df68aef0fafa33fd18a32e939a12d828ee7b3e85e8f06a269ee6484a81fdb4b5eba5210ddc54e0e33e48591e9e410ca4a00b45f19","ssdeep":"6144:wiWK8o/Nj+VUmocN+VU/2bIy56lkz+gcocN+VU/C/o8/WrS:wpuNqUmoc4U/2bIa6lkz+9oc4U/MPgS","tlshash":"e614e17bda3edfa5f70ea0313b50aa116cd0299e58e5f7375910bbd125822ac28dcdc1","first_seen":"2024-05-14T10:06:41Z","last_seen":"2026-07-28T18:14:36.004623Z","times_seen":66,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"msys.ibitao.com//upload/1680111701347447.png","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.679Z","timestamp":1785260564679,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET //upload/1680111701347447.png HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/index/ETH.svg","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.915Z","timestamp":1785260564915,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/index/ETH.svg HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6InE0ekp5R1NLcG5sTmF5VTR2ejc4cGc9PSIsInZhbHVlIjoiYnVSaitsVU9QSlVQdmYxODR1UERhcW43akM3MU96UU9KQWtaZHlUak5CUDFvNlV1RU5sR0FyQlJrcVhHc25JWkNZTXc4cGJWN0VkNmFqZHVlVGFwZ2FjUUVhREtHaEFzOVB4aUd5U2xNNmlSb0dHR2Q1bWpiMU9xK2ZhZUlISlgiLCJtYWMiOiI4ODM0NTVmYmU5OWE5ZTgwMGMyNjNkNzc2ZjYyN2Y5OTU3Y2M2Mjg3YTYyZGU5MzFjZTkyYWE3N2JjNDJkMzg4In0%3D\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1013\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\netag: \"67bd4edf-3f5\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1013,"size_decoded":1286,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"995d2d4482156165e67e3daa2b843e67","sha1":"93394d0024af1b47fee94c6cbdd30ce343c4aa7e","sha256":"ba137cbf25205f14ead99cc95382e430027d791c37cd242db0ae3b78a9e29379","sha512":"8e7be1d95f68db8c2665169cfe567568d17c311fd9ebcf65193e042a5d95fa2140ce22ede98b56490796a60e3f88e333eda3bcc3cee2a9f13f50c137686c603d","ssdeep":"","tlshash":"5811ebbcd76ca26dc1774bb8ee7494c0135d71ed720806dab74c2228d315aeabe06e10","first_seen":"2023-12-11T05:26:44Z","last_seen":"2026-07-28T18:14:35.963045Z","times_seen":80,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"wss","addr":"wss://msys.ibitao.com/socket.io/?EIO=3\u0026transport=websocket","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"websocket","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:43:10.309Z","timestamp":1785260590309,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /socket.io/?EIO=3\u0026transport=websocket HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-WebSocket-Version: 13\r\nOrigin: https://h5.ibitao.com\r\nSec-WebSocket-Extensions: permessage-deflate\r\nSec-WebSocket-Key: bqo/Ig+Esty4GWu6vgMaYg==\r\nSec-GPC: 1\r\nConnection: Upgrade\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: websocket\r\nSec-Fetch-Site: same-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nUpgrade: websocket\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-borr~f5e31127.bc60d92b.js","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.958Z","timestamp":1785260563958,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/js/pages-common-aboutus~pages-common-area~pages-common-article~pages-common-borrowing~pages-common-borr~f5e31127.bc60d92b.js HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-eba0\"\r\nexpires: Wed, 29 Jul 2026 05:42:44 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":60320,"size_decoded":9893,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (59964), with no line terminators","md5":"8561609e58681cbde869241fe1c40240","sha1":"610ae5f9a2afcd74b67f50035e08ddbc8b11d771","sha256":"256a2e7a9c840b6b9d23ec9b4b8b753e2e36ae53d1b2e1eb8c145d46b50f6897","sha512":"8f4e4c935865f7241981f22de0a788426d490a95dc2cff36d4c3ce3e0b629d4c2f34833c81b7623bca009a89de784765667d2c3eaa56c79311cc469d2b5f0ba3","ssdeep":"384:VGmzSk0iieRhBpPfoANf6QvKdSsbWK+8E49:Vn069f6QiEsb5","tlshash":"59431a83f5c8a0944567cfa19f413efc9e2aae638201ec52d843af364e975c7370a59d","first_seen":"2025-10-09T10:46:45.41612Z","last_seen":"2026-07-28T18:14:35.985555Z","times_seen":9,"resource_available":true,"data":null}},"time_used":168,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":168,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/nav/nav-5.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.991Z","timestamp":1785260563991,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/nav/nav-5.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\ncontent-length: 529\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\netag: \"67bd4edf-211\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":529,"size_decoded":869,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"293525aa84aa547e82cc41b3cd7b2924","sha1":"cb58b82eb770f79ce25df5f50fb4b65c0e933fc3","sha256":"b5e6c18e75a97e753dcc1035aa4813163203642528d67103b1ddec5ca7a23911","sha512":"1208808526f0c2a278e0a39c86a6e345bae22644702cd5e0bf0d626cfee4fbb7e223c016c63a2778aeed00681e6e717df404b05b524d43b08b8504eb00c04a6c","ssdeep":"","tlshash":"1df020f3b3218cbcc18ed35242566cabfe0c658623aad64c2309ae36003128f5280e42","first_seen":"2024-08-19T23:01:21.422433Z","last_seen":"2026-07-28T18:14:35.978712Z","times_seen":103,"resource_available":false,"data":null}},"time_used":291,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":291,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/api/currency/quotation_new?lang=en","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.355Z","timestamp":1785260564355,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /api/currency/quotation_new?lang=en HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAuthorization: \r\nContent-Type: application/x-www-form-urlencoded\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nCookie: angela_session=eyJpdiI6IlE3TnhzbjZIaDRNRW1DYVZZVHVyK2c9PSIsInZhbHVlIjoiVWszcHQ5WnNQeTh4Y05TMUlhXC9CMElMNUZtdEp4alAweWg1RWU1Q3VxaXQyS0t3T3hTbDEzZjBFMmhTRFFWUFB2QUYxYTRGRm9YcGh6dk8zRjV2clduUTFtajFYb3oxbExXYlpETk1oVWttNGtsXC9GcGk0c3k2dVprVlwvMVNUZHciLCJtYWMiOiIwZTZlNGFjMTAzNmY2NDllYTU2ZDdhYjIxZDUxMDNmM2E0ODAxYzhiM2M2YmE5MjUyYWZkOWQzYjgyYjllZDEwIn0%3D\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: application/json\r\nvary: Accept-Encoding, Accept-Encoding\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST,GET,OPTIONS,DELETE\r\naccess-control-allow-headers: x-requested-with,content-type,Authorization\r\ncache-control: private, must-revalidate\r\npragma: no-cache\r\nexpires: -1\r\nset-cookie: angela_session=eyJpdiI6InE0ekp5R1NLcG5sTmF5VTR2ejc4cGc9PSIsInZhbHVlIjoiYnVSaitsVU9QSlVQdmYxODR1UERhcW43akM3MU96UU9KQWtaZHlUak5CUDFvNlV1RU5sR0FyQlJrcVhHc25JWkNZTXc4cGJWN0VkNmFqZHVlVGFwZ2FjUUVhREtHaEFzOVB4aUd5U2xNNmlSb0dHR2Q1bWpiMU9xK2ZhZUlISlgiLCJtYWMiOiI4ODM0NTVmYmU5OWE5ZTgwMGMyNjNkNzc2ZjYyN2Y5OTU3Y2M2Mjg3YTYyZGU5MzFjZTkyYWE3N2JjNDJkMzg4In0%3D; expires=Tue, 28-Jul-2026 19:42:44 GMT; Max-Age=7200; path=/; httponly\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32491,"size_decoded":3852,"mime_type":"application/json","magic":"JSON text data","md5":"49c5ae5202e802b7d1f4d4017e3577b5","sha1":"5a1024461e2235976287b3682a5b4e86d12cab1a","sha256":"9971d266cf9abb14be55c5e5368aedaf63a9f9de786fa0391e8742922b1fafaa","sha512":"3d6820bc8cef88653049e624f92c9221d78b55895a2edcc5ffb508085379af22891b7f58932a7c19232792caabe2d7e02faf2e3d8308af0e727658b5ccdd1c1a","ssdeep":"768:GojECVQy8W4Nh3VbkAVJGZmKi+MjkjtQ/iUub3oJBPki9PJ:rqf","tlshash":"8be2f29d632d8ab8c6f65ec2dede319e3580b407aed24f81d3dd5fc84684567e20b502","first_seen":"2026-07-28T17:43:24.053584Z","last_seen":"2026-07-28T17:43:24.053584Z","times_seen":1,"resource_available":false,"data":null}},"time_used":500,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":500,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"msys.ibitao.com//upload/1680111669309314.png","fqdn":"msys.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:44.677Z","timestamp":1785260564677,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET //upload/1680111669309314.png HTTP/1.1\r\nHost: msys.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-28T23:56:24.745269Z","times_seen":17588946,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-28T17:42:41.891Z","timestamp":1785260561891,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:42 GMT\r\ncontent-type: text/html\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-5ac\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1452,"size_decoded":1010,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (781), with CRLF, LF line terminators","md5":"615a35b88e965e0959d9892e752ba524","sha1":"f7d1170c19fa0cb2e4f9ee864c5b47713b37e2cf","sha256":"34c055bbc107fcc86c9b808f3dde7f984b5c86240d2453d840fa181161490bcb","sha512":"7fc5125983347175db06851326a11e3aee23710ba51bc7d5fe49bcf48c9c19f302f98b65173a7d0b316670eabd49d2b26f6f21ec4686aaf9fe78063cf243a6c4","ssdeep":"","tlshash":"983144d39d00d14c1a60a56db57ef26c88fdc1261c51e881b8cc2cec8ec4fc84a7aa36","first_seen":"2025-10-09T10:46:45.450589Z","last_seen":"2026-07-28T18:14:35.956581Z","times_seen":9,"resource_available":false,"data":null}},"time_used":492,"timings":{"blocked":-1,"dns":5,"connect":160,"send":0,"wait":160,"receive":0,"ssl":167},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"h5.ibitao.com/static/image/nav/nav-3.png","fqdn":"h5.ibitao.com","domain":"ibitao.com","tld":"com"},"ip":{"addr":"192.238.249.158","port":443,"asn":395954,"as":"LEASEWEB-USA-LAX","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://h5.ibitao.com/","date":"2026-07-28T17:42:43.989Z","timestamp":1785260563989,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web.ibitao.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 20:43:46 GMT","end":"Wed, 21 Oct 2026 20:43:45 GMT"},"fingerprint":{"sha1":"D2:A5:D7:03:4A:75:66:37:6F:1E:93:99:9E:69:77:F0:C8:05:CE:80","sha256":"F3:C3:E0:CD:0D:86:29:9F:2F:CE:24:C9:3C:8C:D2:EE:68:A2:5D:4E:7B:F2:39:CB:68:6E:45:F8:AC:CB:99:92"}}},"request":{"raw":"GET /static/image/nav/nav-3.png HTTP/1.1\r\nHost: h5.ibitao.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://h5.ibitao.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 28 Jul 2026 17:42:44 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 25 Feb 2025 05:02:23 GMT\r\nvary: Accept-Encoding\r\netag: W/\"67bd4edf-5d4\"\r\nexpires: Thu, 27 Aug 2026 17:42:44 GMT\r\ncache-control: max-age=2592000\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1492,"size_decoded":1866,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced","md5":"baa64c2d64354e70359dd6a21a7b3c85","sha1":"02ed077616b10d0298b23968fc60d9336277403a","sha256":"f8b24cd2630b6c4da23afe377823044bcf52cf5a932554efc6a163098de66641","sha512":"08520e855493dbf16fba8df4894451d0911c3db1090423a7dba79cee1255ebbd5f676aa274dc43bd58ee5c0472825b0e09c404aa4bf72f91431d715674ddfb8e","ssdeep":"","tlshash":"bc311cdf207dc7b741107020c27215657c166448851c5137c13875aa152fec420737bc","first_seen":"2024-08-19T23:01:21.420178Z","last_seen":"2026-07-28T18:14:35.963844Z","times_seen":102,"resource_available":false,"data":null}},"time_used":165,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":165,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-28","alert":"Sinkholed","trigger":"h5.ibitao.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}